https://community.splunk.com/t5/Getting-Data-In/Transaction-using-timestamp/m-p/199337#M39472 <P>Have you tried '<CODE>... | sort -evnt_ts | ...</CODE>'?</P> Fri, 10 Jan 2014 12:59:04 GMT richgalloway 2014-01-10T12:59:04Z https://community.splunk.com/t5/Getting-Data-In/Transaction-using-timestamp/m-p/199336#M39471 <P>I have the following query. <BR /> index="someindex" | sort +evnt_ts | transaction dcn,evnt_ts keepevicted="t"| table dcn,_time,evnt_ts</P> <P>There are 15 events for each dcn. When I do 'transaction dcn', I get the results properly with evnt_ts grouped together. I need to results come in ascending time sequence as I want to use 'delta' command to find the time difference between each events. When I run the above query, the timestamp is always in reverse order (most recent time first). I even tried |reverse. Nothing works. Any luck. </P> Mon, 28 Sep 2020 15:37:26 GMT https://community.splunk.com/t5/Getting-Data-In/Transaction-using-timestamp/m-p/199336#M39471 Sriram 2020-09-28T15:37:26Z https://community.splunk.com/t5/Getting-Data-In/Transaction-using-timestamp/m-p/199337#M39472 <P>Have you tried '<CODE>... | sort -evnt_ts | ...</CODE>'?</P> Fri, 10 Jan 2014 12:59:04 GMT https://community.splunk.com/t5/Getting-Data-In/Transaction-using-timestamp/m-p/199337#M39472 richgalloway 2014-01-10T12:59:04Z https://community.splunk.com/t5/Getting-Data-In/Transaction-using-timestamp/m-p/199338#M39473 <P>Yes. I got the same result with event_ts, how sort using _time helped.I managed to make it work by specifying "startwith" as well as with those sort as there are many similar transaction with same dcn. Thanks again. </P> <P>index="someindex" | transaction dcn startswith="020"| eval "Response Time(Secs)" = round(duration,2) | eval "Event Time"=strftime(_time, "%m-%d-%Y %H:%M:%S") | rename rcvd_dt as "Received Date" dcn as DCN | table "Event Time", "Received Date" , DCN, , "Response Time(Secs)" | sort -"Event Time"</P> Mon, 28 Sep 2020 15:38:30 GMT https://community.splunk.com/t5/Getting-Data-In/Transaction-using-timestamp/m-p/199338#M39473 Sriram 2020-09-28T15:38:30Z