Sort issue

[jugarugabi]

Hey all, 

I am having a file that has the following stuff:

#9
#10
#4
#1
..
#6

For everything that is not #9 or #10, I already made a replacement and it shows #other for #4/#6, etc. 
But when the statistics are shown, I am seeing the following order: 

#10
#9
#other

I want to have the following output: 
#9
#10
#other. 

The search string i am using here is not providing the desired output: 

index = app_events_dbdetect_actimize_event_us_uat sourcetype = txndata Return_code_sent_to_SIL="#*"
| eval Return_code_sent_to_SIL=if(Return_code_sent_to_SIL="#9" OR Return_code_sent_to_SIL="#10", Return_code_sent_to_SIL, "#other")
| top limit=0 Return_code_sent_to_SIL
| inputlookup append=true lookup_0_error_totals.csv
| stats max(count) as "Total errors" by Return_code_sent_to_SIL
| rename Return_code_sent_to_SIL as "#error"
| eval sort_Return_code_sent_to_SIL=case("#error"="#9",1, "#error"="#10",2, "#error"="#other",4) | sort by sort_Return_code_sent_to_SIL

What am I doing wrong? 

Thanks!

[jugarugabi]

So I needed to remove the # there for the sorting to work out. 

Thanks!

[scelikok · Accepted solution]

Hi @jugarugabi,

Please try below;

index = app_events_dbdetect_actimize_event_us_uat sourcetype = txndata Return_code_sent_to_SIL="#*"
| eval Return_code_sent_to_SIL=if(Return_code_sent_to_SIL="#9" OR Return_code_sent_to_SIL="#10", Return_code_sent_to_SIL, "#other")
| top limit=0 Return_code_sent_to_SIL
| inputlookup append=true lookup_0_error_totals.csv
| stats max(count) as "Total errors" by Return_code_sent_to_SIL
| eval Return_code_sent_to_SIL=replace(Return_code_sent_to_SIL,"#","")
| sort Return_code_sent_to_SIL
| eval Return_code_sent_to_SIL="#".Return_code_sent_to_SIL