Splunk Search

Sorting bucketed data



We have a requirement to show data in bucketed format.

Avg Data Delivered    Count
< 50 MB               3450
< 100 MB              200
< 250 MB              350
< 500 MB              1000
< 1 GB                120
> 1 GB                55

The problem we are facing is: Since the data gets sorted as string, 100 MB appears first and then 50 MB.. and so on... How to render the results as mentioned in example above. Basically i would like to disable default sorting.

One option i thought is to use python scripts. Format the data in script and then render it on screen. I would like to know if there is an option in splunk query itself.



Tags (2)


Well you need SOME way of sorting so just "disabling" the default sorting wouldn't be enough. What I think you should do is to convert the "Avg Data Delivered" values to something where all quantities share a common unit, like KB for instance. You could do this using convert's memk() function (see http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Convert ). This will let you sort your data correctly. I suspect you still want to SHOW the data just like now though - in which case you could use fieldformat to set that up.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...