- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When showing data through table, can't sort in descending order because null > any numerical value
So I am displaying a ton of events with a very long table with tons of fields (input pkt, output pkt, input octet, output octet, duration...etc) to allow a user to quickly sort by whichever field they choose fit. The problem is when I try to sort through descending order, the null field is considered greater than any of the numerical values, so I have 10+ pages of straight null fields, but I don't want to exclude events with null values and I don't want to represent null fields with zero because that means two different things.
Is there a way to go about fixing the sorting issue caused by null?
My abbreviated search looks as follows
sourcetype=Alpha|table Username, IP_Address, Input_Octets|sort -Input_Octets
which outputs something like
Username | IP Address | Input_Octets
derp | 10.203.... | null
\\\20 pages of null value in input_octet
derp | 10.203.... | 1321234
derp | 10.203.... | 123441
derp | 10.203.... | 0
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

try like
sourcetype=Alpha|eval Input_Octets=if(Input_Octets!="null",Input_Octets,-1)|table Username, IP_Address, Input_Octets|sort -Input_Octets
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi kkas,
Try with
sourcetype=Alpha|table Username, IP_Address, Input_Octets|sort -num(Input_Octets)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try again with auto attribute. This will determine automatically how to sort the Input_Octets's values.
sourcetype=Alpha|table Username, IP_Address, Input_Octets|sort -auto(Input_Octets)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Cool, this worked for the most part. The one issue I have with this solution is when you try to click the different field tabs at the top to re-sort in different order, it goes back to being null>#. This conflicts with what I'm trying to do to allow the user to sort by clicking the field tabs for quick data analysis of different fields. I may just replace null with -1 and note the change in panel title.
Thanks for your input!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do you want other solution?
