Splunk Search

How can I sort field values depending on the another field values ?

varun99
Path Finder

alt textPFB the search query that I am using for my panel. PFA the view of th dashboard as well.

index=scampservices OSIT4 sourcetype=RA* OR sourcetype=RIM* OR sourcetype=LMLo*| rex "(?ms)(?.?)\" | rex "(?ms)(?.?)\" | rex "^(?P\d+\s+\w+\s+\d+\s+\d+:\d+:\d+)" | rex "(?ms).(?.?)\" | rex "^(?:[^-\n]-){5}(?P\d+)" | rex "^(?:[^-\n]-){5}(?P[^ ]+)" | rex "[\s][TransactionD:][\s\n][#=]+[\n](?.?)[-#]+\n" | rex "[\s]Data:[\s\n][=]+\n*(?.?)[\s]-" | eval Status=coalesce(RIMStatus, RAStatus) | stats values(JobIDThread) as JobIDThread values(Status) as Status values(Resource) as Resource values(Timestamp) as Timestamp values(SoapAction) as SoapAction values(Consumer) as Consumer values(sourcetype) as ESFComponent by JobID | search Resource=$Resource_Email$

The Status values are being displayed sorted in alphabetical order. I want to sort them according to the JobThreadID values.
Kindly help.

0 Karma
1 Solution

micahkemp
Champion

Does | sort JobThreadID not work?

Edit:

You have multiple fields that are multivalue in a single event. This means that JobThreadID isn't necessarily related to the other values in the other fields that appear to be on the same line. You'll have to do something different in your search if you want to know which other values relate to JobThreadID.

View solution in original post

0 Karma

micahkemp
Champion

Does | sort JobThreadID not work?

Edit:

You have multiple fields that are multivalue in a single event. This means that JobThreadID isn't necessarily related to the other values in the other fields that appear to be on the same line. You'll have to do something different in your search if you want to know which other values relate to JobThreadID.

0 Karma

varun99
Path Finder

No, it doesn't. It's sorting the rows depending on the JobIDThread, not the Status field.

0 Karma

varun99
Path Finder

As a workaround, I concatenated the JobIDThread with the Status 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...