Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Sorting Rex extracted test
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
My rex output extract gives following output in different environment. Is there any query to sort the returned text so that we get similar output all the time?
DocumentID=xxxx,ResponseType=xxxx,PO=xxxx,VID=xxxxx
DocumentID=xxxx,PO=xxxxx,VID=xxxx,ResponseType=xxxxx
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Assuming the whole string DocumentID=xxxx,ResponseType=xxxx,PO=xxxx,VID=xxxxx (and other value) are extracted from raw data as part of a single value field, the rex command itself can't change the value available in raw data. You may manipulate the value after extractions. Following example will sort the value based on the key names inside your field (e.g. DocumentID, ResponseType etc) and always return in order DocumentID=xxxx,PO=xxxx,ResponseType=xxxx,VID=xxxxx
your base search | rex "...(?<FieldNameHere>...." | makemv FieldNameHere delim="," | eval FieldNameHere=mvsort(FieldNameHere) | nomv FieldNameHere
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Assuming the whole string DocumentID=xxxx,ResponseType=xxxx,PO=xxxx,VID=xxxxx (and other value) are extracted from raw data as part of a single value field, the rex command itself can't change the value available in raw data. You may manipulate the value after extractions. Following example will sort the value based on the key names inside your field (e.g. DocumentID, ResponseType etc) and always return in order DocumentID=xxxx,PO=xxxx,ResponseType=xxxx,VID=xxxxx
your base search | rex "...(?<FieldNameHere>...." | makemv FieldNameHere delim="," | eval FieldNameHere=mvsort(FieldNameHere) | nomv FieldNameHere
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This worked. Thank you!
you are awesome!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you just wanting to order your fields ?
Maybe add
|stats count(DocumentID) as COUNT by DocumentID, ResponseType,PO,VID
Or whatever order you want them in or counted by.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks Duke! Since the extracted text was part of a single value field this solution didn't work.
Appreciate your response though!
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
