Splunk Search

sort on second field of mvzipped field

splunkdivya
Explorer

Hi,

I have a multivalue field with the name of user and the monthly expenses and another column of time. e.g:
column1 | column2

John-100 | Jan 2018
George-144 | Jan 2017

Jenny-400 |
Rose-391|Feb 2018
Jasmine-25|April 2017
Alice-23|

I need to first sort on time and then the expenditure. The Name and expenditure column is multivalue value field created by mvzip. The desired output looks like:

Rose-391 | Feb2018
John-100 | Jan 2018
Jasmine-25|April 2017
Alice-23|
Jenny-400 | Jan 2017

George-144 |

P.S. Jenny and George are values for Jan 2017, likewise Jasmine and Alice for April 2017.

Let me know for pointers. mvsort didnt work for me... May be I am missing on something.

Best,

0 Karma

logloganathan
Motivator

Hi Divya,

this is command i can provide for you..from there you can develop

| makeresults | eval name="rose,jose,jenny,george"|eval expenditure="100,23,24,111"|eval name=split(name,",")|eval expenditure=split(expenditure,",") |eval total=mvzip(name,expenditure,"----") | eval sorted=mvsort(total) | table sorted

result:
george----111
jenny----24
jose----23
rose----100

0 Karma

p_gurav
Champion

Can you give query your are using?

0 Karma

splunkdivya
Explorer

Thanks for your response,

PFB a dummy query:

| makeresults | eval name="rose,jose,jenny,george"|eval expenditure="100,23,24,111"|eval name=split(name,",")|eval expenditure=split(expenditure,",")|eval total=mvzip(name,expenditure,"----")

Output should be:
Jose-23
Jenny-24
rose-100
goerge-111

Please let me know if this clears the confusion.

Best,

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...