Hello,
I am having values of a particular application as below.
Looking to get the maximum version value or sorting them in order so that i can pick the last/first value in my search.
Values i have for applicationA:
Value i am looking for :
I know we can use case() to add numbers and sort in order. But i have more than 20+ applications with similar data.
Out of them i have to get the Maximum values for each application data.
Regards.
When I have to do this, I'm quite surprised that SPL hasn't offered a function for just this. Searching this forum discovered multiple workarounds based on conversion to numerals, padding 0, etc., perhaps the earliest from 2015. But this 2018 solution by @acharlieh is more intriguing: https://community.splunk.com/t5/Splunk-Search/Help-With-Sorting-Multiple-Decimal-Points/m-p/314798/h.... It doesn't modify the field value, which can of practical importance; instead, it uses ip() function to sort each dot section numerically:
| sort ip(version)
The post discusses its limitations, but should work well for most use. (The dotted notation doesn't have to be 4 sections.) Thanks, @acharlieh!
Thank you. I have got what i am looking for.
Hi, you can also extract each part of the field and then display only the maximum value:
|rex field=ApplicationA "^(?P<m1>\d+)\.(?P<m2>\d+)\.(?P<m3>\d+)"|eventstats max(m1) as max_first_part|sort- m2|where m1=max_first_part|head 1
You could add a leading zero to the middle part of the version number so that they will sort lexicographically
| rex mode=sed field=versions "s/\.(?<digit>\d)\./.0\1./g"