I imported data from jamf cloud into splunk and one of the fields being returned is the operating system version. It seems to be in a x.y.z format. I am removing the last two characters to get a count of the "major" versions to get a report by count. So far this works, but I'm trying to sort by the operating system version and the sorting doesn't seem to work. This is my search:
index="endpoint_apple" sourcetype="jamf:computers" | eval Operating_System_Version_Major = substr(Operating_System_Version, 1, len(Operating_System_Version)-2) | chart count(Operating_System_Version_Major) as count by Operating_System_Version_Major | sort -Operating_System_Version_Major
I cannot figure out why 10.7 through 10.9 are being sorted higher than 10.15. I've tried "sort -num*Operating_System_Version_Major)" with no change, and I also have alternated between "chart" and "stats" to get the count. I've also attempted to remove the eval and just sort on Operating_System_Version with the same results. I'm not really sure what I'm missing, so if someone can point me in the right direction, I'd appreciate it.