https://community.splunk.com/t5/Getting-Data-In/How-to-sort-the-contents-of-a-list-by-timestamp/m-p/352048#M64547 <P>I'm currently querying</P> <PRE><CODE>source="log" | stats list by Id </CODE></PRE> <P>Which gives me nicely grouped data.</P> <P>However I would like the content of those groups sorted by <CODE>Timestamp</CODE>.<BR /> That is to say I do not want the groups themselves sorted but the records inside each group.</P> Wed, 20 Sep 2017 14:09:49 GMT whydoineedtoreg 2017-09-20T14:09:49Z https://community.splunk.com/t5/Getting-Data-In/How-to-sort-the-contents-of-a-list-by-timestamp/m-p/352048#M64547 <P>I'm currently querying</P> <PRE><CODE>source="log" | stats list by Id </CODE></PRE> <P>Which gives me nicely grouped data.</P> <P>However I would like the content of those groups sorted by <CODE>Timestamp</CODE>.<BR /> That is to say I do not want the groups themselves sorted but the records inside each group.</P> Wed, 20 Sep 2017 14:09:49 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-sort-the-contents-of-a-list-by-timestamp/m-p/352048#M64547 whydoineedtoreg 2017-09-20T14:09:49Z https://community.splunk.com/t5/Getting-Data-In/How-to-sort-the-contents-of-a-list-by-timestamp/m-p/352049#M64548 <P>Right now they will sorted in reverse-chronological/descending order of timestamp (_time field). Do you want to sort in ascending/chronological order? If yes, try like this</P> <PRE><CODE>source="log" | reverse | stats list by Id </CODE></PRE> Wed, 20 Sep 2017 15:18:03 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-sort-the-contents-of-a-list-by-timestamp/m-p/352049#M64548 somesoni2 2017-09-20T15:18:03Z