When firewall logs come in, I use an API call to pull in an IP Abuse Score (0-100). I am trying to build a dashboard to list the destination IPs and their score, sorted on their IP Abuse Score. i.e., put the IP with the highest score at the top, lowest score at the bottom of the list.
I have the widget created, and I have set it to sort on the IP Score in descending order. However, it is not treating the field as a number in the way it sorts. What I mean is; it puts anything that starts with a 9 first, then 8, then 7 and so on.
I end up with a list sorted as such, as an example:
9
8
4
25
2
15
1
Is there something special I need to do to get Graylog to treat the field values as true numbers in its sort?
I believe you are running into a limitation of the table widget: If you group numeric and non-numeric fields, then you cannot sort those columns numerically.
The workaround is to not group the numeric column you wish to sort on.
We’ve added a work item to improve this.
I do not believe that is it. I just modified the data table so that the only thing being reported is the field in question and the sort is still not working.
Here is what I have:
