Splunk Search

Sort in an order

romansha
Loves-to-Learn Lots
Is there a way to sort field 09 Sep-256789 in descending order?
 
For example, if we have sample fields 10 Sep-26789  ,31 Aug- 256670 , 09 Sep-256789 . It should sort in order 
 
Before Sort -10 Sep-26789  , 09 Sep-256789  ,31 Aug- 256670 
After Sort-  31 Aug- 256670 ,  09 Sep-256789  ,  10 Sep-26789  
 
Number '26789 ' attached to month is a random number .
 
 
Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

If you want to order columns in that date order, then you cannot sort columns. You can use 

| table a b c d e f

but that's probably not useful, so in the past I have used transpose to turn columns to values, then sort the values (first converting them to dates) and then transpose back to columns, along the lines of

 

| makeresults
| eval cols=split("10 Sep-26789,09 Sep-256789,31 Aug-256670,10 Sep-26780",",")
| mvexpand cols
| eval mydata=random()
| fields - _time
| eval d=strptime(cols,"%d %b")
| rex field=cols "-(?<id>\d+)"
| sort d id
| transpose 0 header_field=cols

See how the transpose at the end converts the sorted cols field back to columns in the right order.

Not sure how this will work with your data though.

If you are actually talking about field values with those values, then the last part will do the sort, i.e.

| eval d=strptime(cols,"%d %b")
| rex field=cols "-(?<id>\d+)"
| sort d id

of course, you don't have a year, so that will not work around Dec/Jan. The rex statement is just to correctly sort those random ids if there is the same date.

Hope this is useful

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

the easiest way is convert date as epoch then sort with it and then remove/hide that field.

...
| eval sTime = substr(your_field, 1, 6), rTime = substr(your_field, 7)
| eval sTime = strptime(sTime, "%d %b")
| sort sTime, rTime
| fields - sTime, rTime 

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...