Splunk Search

Sort based on Specific Value Within Field

raby1996
Path Finder

Hi all
My question has to do with sorting , and basically my field looks like this where I want it sorted by the last bit that is in parenthesis ( as shown),

Dec12(V7)
April13(V71)
Nov14(V74)

However when I use the sort command I get back the field sorted in alphabetical order so-

April13(V71)
Dec12(V7)
Nov14(V74)

Is there any way I can achieve this?
Thank you

Tags (2)
0 Karma
1 Solution

mporath_splunk
Splunk Employee
Splunk Employee

You could create an auxiliary field that you eventually hide from your results:

... | rex field=myfield "[A-Za-z]+\d{2}\(V(?<newfield>\d{2})\)" 
| convert num(newfield)
| sort newfield 
| fields myfield

rex will create a new field that only contains the numeric portion in parentheses. Since you probably want to display V8 before V70 you need to treat the new field as a number, ignoring the "V".

Finally you can just ignore newfield for displaying purposes

View solution in original post

mporath_splunk
Splunk Employee
Splunk Employee

You could create an auxiliary field that you eventually hide from your results:

... | rex field=myfield "[A-Za-z]+\d{2}\(V(?<newfield>\d{2})\)" 
| convert num(newfield)
| sort newfield 
| fields myfield

rex will create a new field that only contains the numeric portion in parentheses. Since you probably want to display V8 before V70 you need to treat the new field as a number, ignoring the "V".

Finally you can just ignore newfield for displaying purposes

raby1996
Path Finder

I apologize for such a late response,but would it it be possible to do this, where this field is derived from a csv file ( named "Group") that I'm comparing to my search data?

0 Karma

mporath_splunk
Splunk Employee
Splunk Employee

I think so! You can define a lookup from a CSV and pull in any data that's part of the CSV as long as you can match the value of one CSV column to a field in your event data. Take a look at the documentation for more details on lookups.

0 Karma

raby1996
Path Finder

Great, thank you!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...