Splunk Search

Sort fields by date

baranova
New Member

Hello There ,

Basically I have some dates in this format :

01/13 700
02/13 600
...
01/14 500

I use these fields for a chart

I wanna sort them in calendar order but I get

01/14 531
02/14 513
03/14 545
04/13 145
04/14 94
05/13 198
06/13 14
07/13 143
08/13 1234
09/13 899
10/13 508
11/13 33

Could you Help me ?

Tags (1)
0 Karma
1 Solution

dwaddle
SplunkTrust
SplunkTrust

Splunk's sort is lexicographical. Your data as-is won't sort right using a lexicographical approach. Let's borrow a pattern from Python (who borrowed it from lisp), Decorate-Sort-Undecorate

| rex field=datefield "(?<temp_mon>\d\d)/(?<temp_year>\d\d)"
| sort temp_year, temp_mon
| fields -temp_year,temp_mon

We add two new fields that sort in the right order, do the sort, then throw away the temporary fields. Result is data sorted like you wanted.

View solution in original post

0 Karma

baranova
New Member

Hello dwaddle and thanks for your quick answer. Works like a charm!

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Splunk's sort is lexicographical. Your data as-is won't sort right using a lexicographical approach. Let's borrow a pattern from Python (who borrowed it from lisp), Decorate-Sort-Undecorate

| rex field=datefield "(?<temp_mon>\d\d)/(?<temp_year>\d\d)"
| sort temp_year, temp_mon
| fields -temp_year,temp_mon

We add two new fields that sort in the right order, do the sort, then throw away the temporary fields. Result is data sorted like you wanted.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...