I have data that is using a different charset.
When displaying this data in a simple table, Splunk parses it as string and applies same rules when sorting it, by bytes.
This causes the text to be sorted like this:
A, B, C .... X, Y, Z, local_char_1, local_char_2 etc.
That's correct when just checking bytes (unicode), however our alphabet is different. Is it possible to modify the sort command's behavior so it sorts text like this:
A, B, C, local_char_1, D, E ....
The issue is that I want to allow the user to sort as he/she wants in the interface, by any column that is displayed in the table. I can maybe use a hidden variable that is populated by my external script but that will work for first display only, as far as I understand.
To use a fancy word, you're wanting to change the "collating sequence" for sort. As far as I know this is not possible directly out of the box. This type of internationalization support could make a good enhancement request. There's a chance that the collating sequence is governed by the language settings in Splunk, but I've not tested.
In a worst case, you could implement your own sort algorithm using a custom search command. Then you are free to define whatever collating sequence you require.
Thanks - does that mean I just create a new command and use it like this:
old search | mysearch
How will this work when the user clicks on the sort button in the table? Generally I have problems only with text fields (due to the character set, obviously), with numbers it (of course) works ok.