Splunk Search

Need to sort macOS versions

jbandautrgv
Engager

I imported data from jamf cloud into splunk and one of the fields being returned is the operating system version. It seems to be in a x.y.z format. I am removing the last two characters to get a count of the "major" versions to get a report by count. So far this works, but I'm trying to sort by the operating system version and the sorting doesn't seem to work. This is my search:

index="endpoint_apple" sourcetype="jamf:computers" | eval Operating_System_Version_Major = substr(Operating_System_Version, 1, len(Operating_System_Version)-2) | chart count(Operating_System_Version_Major) as count by Operating_System_Version_Major | sort -Operating_System_Version_Major

The data is being returned like this:

Operating_System_Version_Major count
10.9 2
10.8 1
10.7 3
10.15 6
10.14 362
10.13 321
10.12 259
10.11 73
10.10 5

I cannot figure out why 10.7 through 10.9 are being sorted higher than 10.15. I've tried "sort -num*Operating_System_Version_Major)" with no change, and I also have alternated between "chart" and "stats" to get the count. I've also attempted to remove the eval and just sort on Operating_System_Version with the same results. I'm not really sure what I'm missing, so if someone can point me in the right direction, I'd appreciate it.

Tags (2)
0 Karma
1 Solution

renjith_nair
Legend

@jbandautrgv,

That's because version is a string and hence it sorts in lexicographical order

Try

index="endpoint_apple" sourcetype="jamf:computers" 
| eval Operating_System_Version_Major = substr(Operating_System_Version, 1, len(Operating_System_Version)-2) 
| chart count(Operating_System_Version_Major) as count by Operating_System_Version_Major 
| eval num=replace(version,"\.","")|sort num|fields - num
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

@jbandautrgv,

That's because version is a string and hence it sorts in lexicographical order

Try

index="endpoint_apple" sourcetype="jamf:computers" 
| eval Operating_System_Version_Major = substr(Operating_System_Version, 1, len(Operating_System_Version)-2) 
| chart count(Operating_System_Version_Major) as count by Operating_System_Version_Major 
| eval num=replace(version,"\.","")|sort num|fields - num
---
What goes around comes around. If it helps, hit it with Karma 🙂

jbandautrgv
Engager

Thank you, I see what you did. I was hoping I could force splunk to treat "10.15" as a decimal and sort it like that, but what you suggested converting "10.15" to "1015" did work.

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...