Splunk Search

Sort Function In splunk

romansha
Loves-to-Learn Lots

Hi ,

I have a  string fields like '28 Aug-1233456' , '05 Jan-5678999' ,'02 Feb-6789011'. I want to sort the field on the basis of date and month .Please let me know how can I sort this fields .

Expected Output :

'05 Jan-5678999' ,02 Feb-6789011',28 Aug-1233456'

Labels (1)
0 Karma

niketnilay
Legend

Can you add your current SPL? Are the fields in the question generated by SPL or available in your raw data!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

the easiest way is convert date as epoch then sort with it and then remove/hide that field.

I'm not sure what you are meaning with that -123456, -34112 etc. Is it just a random number/string or should it contain year, hour, min ....?

 

...
| eval sTime = substr(your_field, 1, 6), rTime = substr(your_field, 7)
| eval sTime = strptime(sTime, "%d %b")
| sort sTime, rTime
| fields - sTime, rTime 

r. Ismo

0 Karma

romansha
Loves-to-Learn Lots

It is just a random number

Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Then my example should do the work.
0 Karma

niketnilay
Legend

@romansha what is your SPL which generates fields like above? We would have to fix the fieldname before making them columns.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.