Sort Function In splunk

[romansha]

Hi ,

I have a  string fields like '28 Aug-1233456' , '05 Jan-5678999' ,'02 Feb-6789011'. I want to sort the field on the basis of date and month .Please let me know how can I sort this fields .

Expected Output :

'05 Jan-5678999' ,02 Feb-6789011',28 Aug-1233456'

[niketnilay]

Can you add your current SPL? Are the fields in the question generated by SPL or available in your raw data!

[isoutamo]

Hi

the easiest way is convert date as epoch then sort with it and then remove/hide that field.

I'm not sure what you are meaning with that -123456, -34112 etc. Is it just a random number/string or should it contain year, hour, min ....?

...
| eval sTime = substr(your_field, 1, 6), rTime = substr(your_field, 7)
| eval sTime = strptime(sTime, "%d %b")
| sort sTime, rTime
| fields - sTime, rTime 

r. Ismo

[romansha]

It is just a random number

[isoutamo]

Then my example should do the work.

[niketnilay]

@romansha what is your SPL which generates fields like above? We would have to fix the fieldname before making them columns.