Splunk Search

## Sorting issue with numeric field, descending order

Communicator

I have a simple search with a sort command at the end as follows:
.... some base search `| dedup id | table id, name | sort -id`

and I'm being presented with the following results:

``````18760000000000166   2020 Summer
18760000000000168   2020 Fall
18760000000000164   2020 Winter
18760000000000165   2020 Spring
18760000000000163   2019 Fall
18760000000000127   2019 Spring
``````

I expected the results to have been ordered by id (descending order). What am I missing?

Tags (3)
1 Solution
Ultra Champion

Solution:

``````| makeresults
| eval _raw="id,name
18760000000000166,2020 Summer
18760000000000168,2020 Fall
18760000000000164,2020 Winter
18760000000000165,2020 Spring
18760000000000163,2019 Fall
18760000000000127,2019 Spring
| table id name
| rex field=id "(?<Upper>\d{10})(?<Lower>\d{7})"
| sort - Upper Lower
| fields - Upper Lower
``````

that's interesting.

sample:

``````| makeresults
| eval _raw="id,name
18760000000000166,2020 Summer
18760000000000168,2020 Fall
18760000000000164,2020 Winter
18760000000000165,2020 Spring
18760000000000163,2019 Fall
18760000000000127,2019 Spring
| table id name
| eval check = tonumber(id)
``````

`id` is huge number. so Splunk has rounded off the number.

Ultra Champion

Solution:

``````| makeresults
| eval _raw="id,name
18760000000000166,2020 Summer
18760000000000168,2020 Fall
18760000000000164,2020 Winter
18760000000000165,2020 Spring
18760000000000163,2019 Fall
18760000000000127,2019 Spring
| table id name
| rex field=id "(?<Upper>\d{10})(?<Lower>\d{7})"
| sort - Upper Lower
| fields - Upper Lower
``````

that's interesting.

sample:

``````| makeresults
| eval _raw="id,name
18760000000000166,2020 Summer
18760000000000168,2020 Fall
18760000000000164,2020 Winter
18760000000000165,2020 Spring
18760000000000163,2019 Fall
18760000000000127,2019 Spring
| table id name
| eval check = tonumber(id)
``````

`id` is huge number. so Splunk has rounded off the number.

Communicator

Oh, I see. It didn't occur to me that Splunk could be rounding out, but it now makes sense. Thanks!

Path Finder

Try forcing splunk to treat the ID field as a number.

``````| sort -num(id)
``````

https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Sort

Communicator

Thanks for your reply. I just tried your suggestion but it's not working (gives me identical results!).

Did you miss .conf21 Virtual?

### Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE! Catch Up Now >>

Get Updates on the Splunk Community!