Is it possible to control how the web interface sorts table column data?
It seems to just sort in ascii or lexical order.
The issue I have is that I have some simple table data that contains dates like the following.
04/Apr/2013
10/Apr/2013
02/Mar/2013
09/Jan/2013
If the web interface sort button is clicked it sorts the list like this :
02/Mar/2013
04/Apr/2013
09/Jan/2013
10/Apr/2013
Where as the expection for a date sort is
09/Jan/2013
02/Mar/2013
04/Apr/2013
10/Apr/2013
I can however work around this by having timeformat as %Y-%m-%d but the client requested format is %d-%m-%y and to be able to sort via this column correctly.
I have the feeling that this is some hardcoded web interface issue right?
Right.
Splunk doesn't know that what you're displaying is a date.
So you need to have the column in a sortable format, then change the way its displayed.
Since you already mention is sorts ok when you have %Y-%m-%d, im guessing you're formating _time, or another epoch field ( in the example mydate )
instead of doing
| eval mydate=strftime(mydate,"%Y-%m-%d")
do
| fieldformat mydate=strftime(mydate,"%d/%b/%Y")
the underlying data is sortable, but the displayed values are readable dates, so sorting will work.
Right.
Splunk doesn't know that what you're displaying is a date.
So you need to have the column in a sortable format, then change the way its displayed.
Since you already mention is sorts ok when you have %Y-%m-%d, im guessing you're formating _time, or another epoch field ( in the example mydate )
instead of doing
| eval mydate=strftime(mydate,"%Y-%m-%d")
do
| fieldformat mydate=strftime(mydate,"%d/%b/%Y")
the underlying data is sortable, but the displayed values are readable dates, so sorting will work.
Thanks. That was it.
I originally used a convert using ctime from epoch. Doing it that way must lose its ability to sort.