topic Re: Is there a difference in efficiency between this sort and reverse? in Splunk Search https://community.splunk.com/t5/Splunk-Search/Is-there-a-difference-in-efficiency-between-this-sort-and/m-p/489139#M136641 <P>When I examine it, <CODE>sort</CODE> takes more time.</P> <P>Also, <CODE>reverse</CODE> is a command that reverses the log order, so if the time series is disjoint, reverse it.<BR /> This is also different from <CODE>sort</CODE> .</P> Sun, 24 Nov 2019 05:38:41 GMT to4kawa 2019-11-24T05:38:41Z Is there a difference in efficiency between this sort and reverse? https://community.splunk.com/t5/Splunk-Search/Is-there-a-difference-in-efficiency-between-this-sort-and/m-p/489136#M136638 <P><A href="https://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/Delta">Delta</A> cites an example using <CODE>sort - _time</CODE>. </P> <P>Is there a difference in efficiency between this sort and <CODE>reverse</CODE>?</P> Fri, 22 Nov 2019 21:23:43 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-difference-in-efficiency-between-this-sort-and/m-p/489136#M136638 yuanliu 2019-11-22T21:23:43Z Re: Is there a difference in efficiency between this sort and reverse? https://community.splunk.com/t5/Splunk-Search/Is-there-a-difference-in-efficiency-between-this-sort-and/m-p/489137#M136639 <P>Using <CODE>reverse</CODE> <EM>should</EM> be much more effiicient because it just rewrites the list whereas <CODE>sort</CODE> must continuously compare values. It should be <CODE>sort 0 + _time</CODE>. </P> Sat, 23 Nov 2019 06:28:33 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-difference-in-efficiency-between-this-sort-and/m-p/489137#M136639 woodcock 2019-11-23T06:28:33Z Re: Is there a difference in efficiency between this sort and reverse? https://community.splunk.com/t5/Splunk-Search/Is-there-a-difference-in-efficiency-between-this-sort-and/m-p/489138#M136640 <P>If you look into the job inspector, you should be able to see the runtime and other diagnostic information for your case as well!</P> Sun, 24 Nov 2019 03:30:53 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-difference-in-efficiency-between-this-sort-and/m-p/489138#M136640 aberkow 2019-11-24T03:30:53Z Re: Is there a difference in efficiency between this sort and reverse? https://community.splunk.com/t5/Splunk-Search/Is-there-a-difference-in-efficiency-between-this-sort-and/m-p/489139#M136641 <P>When I examine it, <CODE>sort</CODE> takes more time.</P> <P>Also, <CODE>reverse</CODE> is a command that reverses the log order, so if the time series is disjoint, reverse it.<BR /> This is also different from <CODE>sort</CODE> .</P> Sun, 24 Nov 2019 05:38:41 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-difference-in-efficiency-between-this-sort-and/m-p/489139#M136641 to4kawa 2019-11-24T05:38:41Z