Splunk Search

how to sort() version values.

karthik_y
Engager

Hello,

I am having values of a particular application as below.

Looking to get the maximum version value or sorting them in order so that i can pick the last/first value in my search.

 

Values i have for applicationA:

1.17.120
2.12.600
2.14.377
2.14.378
2.15.121
2.16.298
2.17.176
2.18.117
2.4.153
2.6.186
2.7.241
2.7.242
2.8.207
2.9.369
 

 

 

Value i am looking for :

2.18.117

 

I know we can use case() to add numbers and sort in order. But i have more than 20+ applications with similar data.

Out of them i have to get the Maximum values for each application data.

 

Regards.

Labels (2)
Tags (1)

yuanliu
SplunkTrust
SplunkTrust

When I have to do this, I'm quite surprised that SPL hasn't offered a function for just this.  Searching this forum discovered multiple workarounds based on conversion to numerals, padding 0, etc., perhaps the earliest from 2015.  But this 2018 solution by @acharlieh is more intriguing: https://community.splunk.com/t5/Splunk-Search/Help-With-Sorting-Multiple-Decimal-Points/m-p/314798/h....  It doesn't modify the field value, which can of practical importance; instead, it uses ip() function to sort each dot section numerically:

| sort ip(version)

The post discusses its limitations, but should work well for most use. (The dotted notation doesn't have to be 4 sections.)  Thanks, @acharlieh

0 Karma

karthik_y
Engager

Thank you. I have got what i am looking for.

0 Karma

stephanefotso
Motivator

Hi, you can also extract each part of the field and then display only the maximum value:

|rex field=ApplicationA "^(?P<m1>\d+)\.(?P<m2>\d+)\.(?P<m3>\d+)"|eventstats max(m1) as max_first_part|sort- m2|where m1=max_first_part|head 1

SGF

ITWhisperer
SplunkTrust
SplunkTrust

You could add a leading zero to the middle part of the version number so that they will sort lexicographically

| rex mode=sed field=versions "s/\.(?<digit>\d)\./.0\1./g"

 

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...