Turn on suggestions

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results for

Splunk Search

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results for

- Community
- :
- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Why are the numbers not sorted as expected in my c...

- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page

Highlighted

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

changux

Builder

05-24-2016
09:52 AM

Hi all.

I have this search:

```
index="bucle_cm" sourcetype="cierres-pendientes" "Tipo Actuacion"="*" "Tipo Actuacion"!=Bajas EMPRES="*" | sort num("DIA CIERRE") | chart count by "Tipo Actuacion","DIA CIERRE" limit=0 | addcoltotals | addtotals fieldname=Total
```

Where `"DIA CIERRE"`

is a number field with values like 1,2,3,4,10,11..etc.

The result set looks like this:

Why are the numbers not sorted?

Thanks!

1 Solution

Highlighted
##

The field names in Splunk are treated as alphanumeric string, not number, hence the column ordering you see here. The sort command before the chart will not have any effect on the output of the chart command.

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: Why are the numbers not sorted as expected in my chart?

somesoni2

SplunkTrust

05-24-2016
09:57 AM

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: Why are the numbers not sorted as expected in my chart?

changux

Builder

05-24-2016
10:02 AM

Thanks. Putting the `sort`

after the `chart`

command give the same ordering issue.

Highlighted
##

There is no good way to sort columns with numbers in it. Do you know if "DIA CIERRE" has fixed number of values??

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: Why are the numbers not sorted as expected in my chart?

somesoni2

SplunkTrust

05-24-2016
10:06 AM

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: Why are the numbers not sorted as expected in my chart?

changux

Builder

05-24-2016
10:09 AM

"DIA CIERRE" is a day in a month, so, in the worst case, you have 31 as fixed value.

Highlighted
##

Does it's value depends upon the time range you run the query for? In other words, is there a way I can find out the max value of "DIA CIERRE" which your search is going to return? I've a workaround but I need to know the max value (and the start value).

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: Why are the numbers not sorted as expected in my chart?

somesoni2

SplunkTrust

05-24-2016
11:00 AM

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: Why are the numbers not sorted as expected in my chart?

changux

Builder

05-24-2016
11:36 AM

With a subsearch like:

```
| stats max("DIA CIERRE")
```

We can obtain this one. In the last case is 11.

Highlighted

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

sundareshr

Legend

05-24-2016
11:48 AM

how about something like this

```
....| eval "DIA CIERRE"=if(len("DIA CIERRE")=1, "0".'DIA CIERRE', 'DIA CIERRE') | chart count over "TIPO" by "DIA CIERRE"
```

Then max value wouldn't matter

Full search

```
index="bucle_cm" sourcetype="cierres-pendientes" "Tipo Actuacion"="*" "Tipo Actuacion"!=Bajas EMPRES="*" .| eval "DIA CIERRE"=if(len("DIA CIERRE")=1, "0".'DIA CIERRE', 'DIA CIERRE') | chart count over "TIPO" by "DIA CIERRE" | addcoltotals | addtotals fieldname=Total
```

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: Why are the numbers not sorted as expected in my chart?

changux

Builder

05-24-2016
11:59 AM

Hi.

I tried first:

```
| eval "DIA CIERRE"=if(len('DIA CIERRE')=1, "0".y, y) | table "DIA CIERRE"
```

And not results. Can you explain please your idea?

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: Why are the numbers not sorted as expected in my chart?

somesoni2

SplunkTrust

05-24-2016
12:21 PM

Replace y with 'DIA CIERRE'.