It looks like your field is not being sorted numerically. For instance, if we create the minimal data set for testing, sorting by the number will order the results by 1, 2, 11 and 111. Here is the data:
1 This is one line
11 This is the third line
111 This is the fourth line
2 This is the second line
This is the search for the data:
sourcetype="answers_q_1369765528" | rex field=_raw "^(?<number>\d+)\s+(?<message>.+?)$" | sort number | table number message
On the other hand, if we alter the data so that the value is considered a string, then the results are different. Here is the search:
sourcetype="answers_q_1369765528" | rex field=_raw "^(?<number>\d+)\s+(?<message>.+?)$" | eval number="a-".number | sort number | table number message
Here are the results. Note that the order reflects your current condition.
Your data is being interpreted as a string and is sorted alphabetically.
PART 2
Given the explanation about sorting the column values in a table, here is a mechanical way to provide a sort using transpose and xyseries. Given the following data set:
A 1 11 111 2 22 222 4
We extract the fields and present the primary data set. Of course there are more elegant ways to do this but this used for testing, not real life 🙂
sourcetype="answers_2" | rex field=_raw "(?<Category>\w+)\s+(?<field1>\d+)\s+(?<field2>\d+)\s+(?<field3>\d+)\s+(?<field4>\d+)\s+(?<field5>\d+)\s+(?<field6>\d+)\s+(?<field7>\d+)" | table field*
Sort according to the desired order by row. N
... | transpose 10 | sort "row 1"
RENAME the field ordering according to sort criteria.
... | eval i=1 | accum i | eval column="field".i | fields - i
Convert table to a single row
... | eval dummy=" " | xyseries dummy column "row 1" | eval dummy="A" | rename dummy AS Category
Now, this not very useful for multi-row tables. I'd have to think about that one. If you do not care about the field naming, this may help. Otherwise, this may confirm the need for a special sort command.
My challenge with a special sort for column values is not the logic but the nature of tables in the Splunk UI. By default the fields are ordered alpha-numerically and field values do not override that default ordering.
