Splunk Search

Magical sort order

yuanliu
SplunkTrust
SplunkTrust

I was surprised by this result: In a field starting with a value that can be interpreted as an integer, groupby treats it lexically, but sort treats it numerically.  How does sort determine the intention?  Is there a syntax to force lexical sort?

To illustrate, consider the following:

 

| makeresults
| eval i = mvrange(-3, 4)
| mvexpand i
| eval i = printf("%+d", i) . "x"
| stats count by i

 

 

 

  • As is (groupby only)
    icount
    +0x1
    +1x1
    +2x1
    +3x1
    -1x1
    -2x1
    -3x1
  • Add |sort i
    icount
    -3x1
    -2x1
    -1x1
    +0x1
    +1x1
    +2x1
    +3x1

In my use case, numeric sort is desired. (That was how I "discovered" this.)  Just curious about mechanism.

Labels (2)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

To see how sort determines how to sort the results, see https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/Sort#Usage . You can override the default by specifying a Sort Field Option.  See https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/Sort#Sort_field_options

Since the manual entry for stats is silent on the subject, I presume it uses lexicographical order.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

To see how sort determines how to sort the results, see https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/Sort#Usage . You can override the default by specifying a Sort Field Option.  See https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/Sort#Sort_field_options

Since the manual entry for stats is silent on the subject, I presume it uses lexicographical order.

---
If this reply helps you, an upvote would be appreciated.

yuanliu
SplunkTrust
SplunkTrust

Thanks for the pointer!  In short, to force lexicographical order, | sort str(i). (I had used sort ip() but didn't know str() was also a directive.)

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>