- Splunk Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- How to disable automatic sorting in table
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to disable automatic sorting in table
Hi,
i have a table displaying log messages alone and their timestamp is same as they have only micro milliseconds difference in their occurrence, in the table the lo details are sorted according to the alphabetic order of the log details, i want it as it is in the log file.. How can i do this?
Please help
Thank you
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Perhaps try changing the sort _time to...
| eval indextime=_indextime | sort indextime
This "may" work better than _time, if not you're just going to have to increase the timestamping on your logs as there is no guarantee it arrives in Splunk in the same order, thus Splunk doesn't know the original order in the log.
DISCLAIMER:
This obviously won't work if you have historical events or any other funny time related business going on.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Any other go?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
it need to change the entire setpu of the product, i dont think it can be done :'(
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The issue is that without finer detail in the timestamp there isn't really any way to ensure it appears as it does in the log. Can you increase the timestamping?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
its not working :'(.. it is not a real time dashboard, i am uploading my logs and then searching on it..
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try
yoursearchhere
| sort _time
| table field1 field2 field3
However, I am not sure that I really undersand the question. It would be better to see your actual search.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
nearly 15 logs with same timestamp.. it will be like
2011-12-13 10:12:12 :ERROR: Target connection group #1 consists of target error
2011-12-13 10:12:12 :INFO :Writer initialization complete.
2011-12-13 10:12:12 :ERROR :DTM log error
2011-12-13 10:12:12 :INFO :Writer run started.
and the output table is like
2011-12-13 10:12:12 :ERROR :DTM log error
2011-12-13 10:12:12 :INFO :Writer initialization complete.
2011-12-13 10:12:12 :INFO :Writer initialization complete.
2011-12-13 10:12:12 :ERROR: Target connection group #1 consists of target error
Please help
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
and how does it appear in the log file?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
this is my search lguinn
index=main source=file.txt|transaction startswith=START endswith=END maxevents=10000 |fields log_details |mvexpand log_details |join log_details [search index=main source=file.txt ]|table _time severity msg_code log_details |fields - _raw |sort _time- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, or perhaps to tell us how it appears in the log file so we actually understand how you want it to look 😛 Its pretty hard to replicate it without knowing! Although Lguinn is probably bang on the money with a sort by time
Introducing the 2024 SplunkTrust!
Introducing the 2024 Splunk MVPs!
Splunk Custom Visualizations App End of Life
