Splunk Search

Sort Function In splunk

romansha
Loves-to-Learn Lots

Hi ,

I have a  string fields like '28 Aug-1233456' , '05 Jan-5678999' ,'02 Feb-6789011'. I want to sort the field on the basis of date and month .Please let me know how can I sort this fields .

Expected Output :

'05 Jan-5678999' ,02 Feb-6789011',28 Aug-1233456'

Labels (1)
0 Karma

niketn
Legend

Can you add your current SPL? Are the fields in the question generated by SPL or available in your raw data!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

the easiest way is convert date as epoch then sort with it and then remove/hide that field.

I'm not sure what you are meaning with that -123456, -34112 etc. Is it just a random number/string or should it contain year, hour, min ....?

 

...
| eval sTime = substr(your_field, 1, 6), rTime = substr(your_field, 7)
| eval sTime = strptime(sTime, "%d %b")
| sort sTime, rTime
| fields - sTime, rTime 

r. Ismo

0 Karma

romansha
Loves-to-Learn Lots

It is just a random number

Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Then my example should do the work.
0 Karma

niketn
Legend

@romansha what is your SPL which generates fields like above? We would have to fix the fieldname before making them columns.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...