topic Re: help for sorting time in Splunk Search

help for sorting time

jip31 — Sat, 31 Oct 2020 06:23:24 GMT

hello

I use a time field like this but I am unable to sort the time with descending sort

How to do this please?

| eval time = strftime(_time, "%m/%d/%Y %H:%M") | rename time as "Event time" | table "Event time" | sort "Event time"

gcusello — Sat, 31 Oct 2020 06:55:50 GMT

to sort time fields you have to convert them in epochtime.

In your case, _time is already in epochtime so you have only to change the order of your commands:

| sort -_time | eval "Event time" = strftime(_time, "%m/%d/%Y %H:%M") | table "Event time"

Ciao.

Giuseppe

jip31 — Sat, 31 Oct 2020 08:07:25 GMT

Thanks Giuseppe

gcusello — Sat, 31 Oct 2020 10:38:57 GMT

good for you.

ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉