Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Sorting Rex extracted test
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
My rex output extract gives following output in different environment. Is there any query to sort the returned text so that we get similar output all the time?
DocumentID=xxxx,ResponseType=xxxx,PO=xxxx,VID=xxxxx
DocumentID=xxxx,PO=xxxxx,VID=xxxx,ResponseType=xxxxx
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Assuming the whole string DocumentID=xxxx,ResponseType=xxxx,PO=xxxx,VID=xxxxx (and other value) are extracted from raw data as part of a single value field, the rex command itself can't change the value available in raw data. You may manipulate the value after extractions. Following example will sort the value based on the key names inside your field (e.g. DocumentID, ResponseType etc) and always return in order DocumentID=xxxx,PO=xxxx,ResponseType=xxxx,VID=xxxxx
your base search | rex "...(?<FieldNameHere>...." | makemv FieldNameHere delim="," | eval FieldNameHere=mvsort(FieldNameHere) | nomv FieldNameHere
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Assuming the whole string DocumentID=xxxx,ResponseType=xxxx,PO=xxxx,VID=xxxxx (and other value) are extracted from raw data as part of a single value field, the rex command itself can't change the value available in raw data. You may manipulate the value after extractions. Following example will sort the value based on the key names inside your field (e.g. DocumentID, ResponseType etc) and always return in order DocumentID=xxxx,PO=xxxx,ResponseType=xxxx,VID=xxxxx
your base search | rex "...(?<FieldNameHere>...." | makemv FieldNameHere delim="," | eval FieldNameHere=mvsort(FieldNameHere) | nomv FieldNameHere
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This worked. Thank you!
you are awesome!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you just wanting to order your fields ?
Maybe add
|stats count(DocumentID) as COUNT by DocumentID, ResponseType,PO,VID
Or whatever order you want them in or counted by.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks Duke! Since the extracted text was part of a single value field this solution didn't work.
Appreciate your response though!
Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...
Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions
Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...
