Splunk Search

how to sort() version values.

karthik_y
Engager

Hello,

I am having values of a particular application as below.

Looking to get the maximum version value or sorting them in order so that i can pick the last/first value in my search.

 

Values i have for applicationA:

1.17.120
2.12.600
2.14.377
2.14.378
2.15.121
2.16.298
2.17.176
2.18.117
2.4.153
2.6.186
2.7.241
2.7.242
2.8.207
2.9.369
 

 

 

Value i am looking for :

2.18.117

 

I know we can use case() to add numbers and sort in order. But i have more than 20+ applications with similar data.

Out of them i have to get the Maximum values for each application data.

 

Regards.

Labels (2)
Tags (1)

yuanliu
SplunkTrust
SplunkTrust

When I have to do this, I'm quite surprised that SPL hasn't offered a function for just this.  Searching this forum discovered multiple workarounds based on conversion to numerals, padding 0, etc., perhaps the earliest from 2015.  But this 2018 solution by @acharlieh is more intriguing: https://community.splunk.com/t5/Splunk-Search/Help-With-Sorting-Multiple-Decimal-Points/m-p/314798/h....  It doesn't modify the field value, which can of practical importance; instead, it uses ip() function to sort each dot section numerically:

| sort ip(version)

The post discusses its limitations, but should work well for most use. (The dotted notation doesn't have to be 4 sections.)  Thanks, @acharlieh

0 Karma

karthik_y
Engager

Thank you. I have got what i am looking for.

0 Karma

stephanefotso
Motivator

Hi, you can also extract each part of the field and then display only the maximum value:

|rex field=ApplicationA "^(?P<m1>\d+)\.(?P<m2>\d+)\.(?P<m3>\d+)"|eventstats max(m1) as max_first_part|sort- m2|where m1=max_first_part|head 1

SGF

ITWhisperer
SplunkTrust
SplunkTrust

You could add a leading zero to the middle part of the version number so that they will sort lexicographically

| rex mode=sed field=versions "s/\.(?<digit>\d)\./.0\1./g"

 

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...