Sort in an order

[romansha]

Is there a way to sort field 09 Sep-256789 in descending order?

For example, if we have sample fields 10 Sep-26789  ,31 Aug- 256670 , 09 Sep-256789 . It should sort in order 

Before Sort -10 Sep-26789  , 09 Sep-256789  ,31 Aug- 256670 

After Sort-  31 Aug- 256670 ,  09 Sep-256789  ,  10 Sep-26789  

Number '26789 ' attached to month is a random number .

[bowesmana]

If you want to order columns in that date order, then you cannot sort columns. You can use 

| table a b c d e f

but that's probably not useful, so in the past I have used transpose to turn columns to values, then sort the values (first converting them to dates) and then transpose back to columns, along the lines of

| makeresults
| eval cols=split("10 Sep-26789,09 Sep-256789,31 Aug-256670,10 Sep-26780",",")
| mvexpand cols
| eval mydata=random()
| fields - _time
| eval d=strptime(cols,"%d %b")
| rex field=cols "-(?<id>\d+)"
| sort d id
| transpose 0 header_field=cols

See how the transpose at the end converts the sorted cols field back to columns in the right order.

Not sure how this will work with your data though.

If you are actually talking about field values with those values, then the last part will do the sort, i.e.

| eval d=strptime(cols,"%d %b")
| rex field=cols "-(?<id>\d+)"
| sort d id

of course, you don't have a year, so that will not work around Dec/Jan. The rex statement is just to correctly sort those random ids if there is the same date.

Hope this is useful

[isoutamo]

Hi

the easiest way is convert date as epoch then sort with it and then remove/hide that field.

...
| eval sTime = substr(your_field, 1, 6), rTime = substr(your_field, 7)
| eval sTime = strptime(sTime, "%d %b")
| sort sTime, rTime
| fields - sTime, rTime 

r. Ismo