topic Re: How to sort the output baed on time and host? in Getting Data In

How to sort the output baed on time and host?

shahhe — Wed, 26 Jan 2011 05:29:43 GMT

How can I order the results by time (_time + _subsecond fields) and then by host field?

Thanks.

Re: How to sort the output baed on time and host?

Paolo_Prigione — Wed, 26 Jan 2011 21:03:15 GMT

Try appending this to your search string:

| sort -_time +host

Which will sort in descending time order, then ascending host order

Re: How to sort the output baed on time and host?

shahhe — Wed, 26 Jan 2011 22:51:41 GMT

Thanks for the answer.
This query returns rows in descending order.
How do I sort in ascending order by time?
When I use +_time I get nothing.

Re: How to sort the output baed on time and host?

shahhe — Thu, 27 Jan 2011 00:33:42 GMT

I also tried '| sort _time' and I get no results.

Re: How to sort the output baed on time and host?

Paolo_Prigione — Thu, 27 Jan 2011 00:41:49 GMT

Could you post your complete search string?

Re: How to sort the output baed on time and host?

shahhe — Thu, 27 Jan 2011 00:44:27 GMT

sourcetype="retrans" daysago="1" WARNING | sort _time

This query works from the web interface, but not from my python script.

Re: How to sort the output baed on time and host?

shahhe — Thu, 27 Jan 2011 02:26:51 GMT

I could not figure out how to markdown text in the comments, so I am posting my script as an answer.

Here is the python script

import time
import string
import splunk 
import splunk.auth 
import splunk.search

searchQuery = r"search sourcetype=retrans daysago=1 WARNING | sort _time"
splunk.mergeHostPath('splunkserv:8089', True) 
key = splunk.auth.getSessionKey('user','passwd') 
job = splunk.search.dispatch(searchQuery) 

while not job.isDone: 
time.sleep(1) 

for x in job.events: 
   print x.fields 

job.cancel()