sort on second field of mvzipped field

[splunkdivya]

Hi,

I have a multivalue field with the name of user and the monthly expenses and another column of time. e.g:
column1 | column2

John-100 | Jan 2018
George-144 | Jan 2017

Jenny-400 |
Rose-391|Feb 2018
Jasmine-25|April 2017
Alice-23|

I need to first sort on time and then the expenditure. The Name and expenditure column is multivalue value field created by mvzip. The desired output looks like:

Rose-391 | Feb2018
John-100 | Jan 2018
Jasmine-25|April 2017
Alice-23|
Jenny-400 | Jan 2017

George-144 |

P.S. Jenny and George are values for Jan 2017, likewise Jasmine and Alice for April 2017.

Let me know for pointers. mvsort didnt work for me... May be I am missing on something.

Best,

[logloganathan]

Hi Divya,

this is command i can provide for you..from there you can develop

| makeresults | eval name="rose,jose,jenny,george"|eval expenditure="100,23,24,111"|eval name=split(name,",")|eval expenditure=split(expenditure,",") |eval total=mvzip(name,expenditure,"----") | eval sorted=mvsort(total) | table sorted

result:
george----111
jenny----24
jose----23
rose----100

[p_gurav]

Can you give query your are using?

[splunkdivya]

Thanks for your response,

PFB a dummy query:

| makeresults | eval name="rose,jose,jenny,george"|eval expenditure="100,23,24,111"|eval name=split(name,",")|eval expenditure=split(expenditure,",")|eval total=mvzip(name,expenditure,"----")

Output should be:
Jose-23
Jenny-24
rose-100
goerge-111

Please let me know if this clears the confusion.

Best,