Splunk Search

Sorting Rex extracted test

nithinthomas
New Member

My rex output extract gives following output in different environment. Is there any query to sort the returned text so that we get similar output all the time?

DocumentID=xxxx,ResponseType=xxxx,PO=xxxx,VID=xxxxx

DocumentID=xxxx,PO=xxxxx,VID=xxxx,ResponseType=xxxxx

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Assuming the whole string DocumentID=xxxx,ResponseType=xxxx,PO=xxxx,VID=xxxxx (and other value) are extracted from raw data as part of a single value field, the rex command itself can't change the value available in raw data. You may manipulate the value after extractions. Following example will sort the value based on the key names inside your field (e.g. DocumentID, ResponseType etc) and always return in order DocumentID=xxxx,PO=xxxx,ResponseType=xxxx,VID=xxxxx

your base search | rex "...(?<FieldNameHere>...." | makemv FieldNameHere delim="," | eval FieldNameHere=mvsort(FieldNameHere) | nomv FieldNameHere

View solution in original post

0 Karma

somesoni2
Revered Legend

Assuming the whole string DocumentID=xxxx,ResponseType=xxxx,PO=xxxx,VID=xxxxx (and other value) are extracted from raw data as part of a single value field, the rex command itself can't change the value available in raw data. You may manipulate the value after extractions. Following example will sort the value based on the key names inside your field (e.g. DocumentID, ResponseType etc) and always return in order DocumentID=xxxx,PO=xxxx,ResponseType=xxxx,VID=xxxxx

your base search | rex "...(?<FieldNameHere>...." | makemv FieldNameHere delim="," | eval FieldNameHere=mvsort(FieldNameHere) | nomv FieldNameHere
0 Karma

nithinthomas
New Member

This worked. Thank you!

you are awesome!

0 Karma

JDukeSplunk
Builder

Are you just wanting to order your fields ?

Maybe add

|stats count(DocumentID) as COUNT by DocumentID, ResponseType,PO,VID

Or whatever order you want them in or counted by.

nithinthomas
New Member

Thanks Duke! Since the extracted text was part of a single value field this solution didn't work.

Appreciate your response though!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...