Splunk Search

Sort Function In splunk

romansha
Loves-to-Learn Lots

Hi ,

I have a  string fields like '28 Aug-1233456' , '05 Jan-5678999' ,'02 Feb-6789011'. I want to sort the field on the basis of date and month .Please let me know how can I sort this fields .

Expected Output :

'05 Jan-5678999' ,02 Feb-6789011',28 Aug-1233456'

Labels (1)
0 Karma

niketn
Legend

Can you add your current SPL? Are the fields in the question generated by SPL or available in your raw data!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

the easiest way is convert date as epoch then sort with it and then remove/hide that field.

I'm not sure what you are meaning with that -123456, -34112 etc. Is it just a random number/string or should it contain year, hour, min ....?

 

...
| eval sTime = substr(your_field, 1, 6), rTime = substr(your_field, 7)
| eval sTime = strptime(sTime, "%d %b")
| sort sTime, rTime
| fields - sTime, rTime 

r. Ismo

0 Karma

romansha
Loves-to-Learn Lots

It is just a random number

Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Then my example should do the work.
0 Karma

niketn
Legend

@romansha what is your SPL which generates fields like above? We would have to fix the fieldname before making them columns.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...