How to Sort data by using the value of Variable Name

[sukansingh]

I have a query and at the end I want to sort the data by specific column But column is dynamically generated. i can get the column name in eval function and store it in variable. Now to use this variable in sort command?

for example my_search | eval date="my logic & let say return '2023-02-02'" | sort - $date

here variable is holding the column_name value and then I want to sort by that column.

Is it possible to sort by column name which is dynamically generated So i won't know the exact name But variable holds the column name So I can just use sort - $Variable?

[gcusello]

Hi @sukansingh,

your request isn't so clear for me because using the search you shared it's easy to sort for the date field:

my_search 
| eval date="my logic & let say return '2023-02-02'" 
| sort -date

if instead the problem is that you haven't a name defined field to sort, you have to find a workaround related to your search, could you share your real search? 

Ciao.

Giuseppe

[sukansingh]

@gcusello 

I have a below Query-

index="services" statusCode="500" | bucket _time span=day | eval time=strftime(_time,"%F") | chart count by customerId,time

Result shown in below screenshot, and I want to sort by last column. Somehow I evaluated what would be column name with below eval function-

| eval max="1900-01-01", reg="^\d{4}-\d{2}-\d{2}$" | foreach * [eval col="<<FIELD>>", max=if(match(col,reg), if(col>max,col,max) ,max)] | sort - max | fields - col max reg

But in above query , sort -max is not working for me.

I'm just looking for a solution to sort this dynamically generated column through query.

[gcusello]

Hi @sukansingh,

youcould use the solution from @ITWhisperer that's correct or use a different approach:

index="services" statusCode="500" 
| timechart span=1d count by customerId

Ciao.

Giuseppe

[ITWhisperer · Accepted solution]

If it is always the last / latest column, you could try something like this

| sort 0
    [| makeresults
    | addinfo 
    | eval search=strftime(info_max_time-1, "%F")
    | fields search
    | tail 1
    | format "" "" "" "" "" ""]

[gcusello]

Hi @sukansingh,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉