https://community.splunk.com/t5/Splunk-Search/Timeformat-not-sorting-properly/m-p/66240#M16443 <P>I figured it out. Timestamps is just a number before you convert the format so it sorts correctly so you need to sort t=he time before you convert the format like this.</P> <P>sourcetype="foo" name="foobar*" | sort - _time | convert timeformat="%m/%d/%Y - %a" ctime(_time) AS Date | convert timeformat="%H:%M:%S.%N" ctime(_time) AS Time | table Time Date host name category | rename host as Server name as Name category as Category </P> Mon, 28 Sep 2020 12:58:50 GMT hartfoml 2020-09-28T12:58:50Z https://community.splunk.com/t5/Splunk-Search/Timeformat-not-sorting-properly/m-p/66236#M16439 <P>I am using this search:</P> <P>sourcetype="foo" name="foobar*" | convert timeformat="%m/%d/%Y - %a" ctime(_time) AS Date | convert timeformat="%H:%M:%S.%N" ctime(_time) AS Time | table Time Date host name category | rename host as Server name as Name category as Category | sort - Time</P> <P>The sort is not working. can anyone suggest what it is I am doing wrong with the sort or timeformat and how to fix it???</P> Mon, 17 Dec 2012 20:27:37 GMT https://community.splunk.com/t5/Splunk-Search/Timeformat-not-sorting-properly/m-p/66236#M16439 hartfoml 2012-12-17T20:27:37Z https://community.splunk.com/t5/Splunk-Search/Timeformat-not-sorting-properly/m-p/66237#M16440 <P>Maybe I'm wrong but should it work if :</P> <P>sourcetype="foo" name="foobar*" | convert timeformat="%m/%d/%Y - %a" ctime(_time) AS Date | convert timeformat="%H:%M:%S.%N" ctime(_time) AS Time | sort - Time | table Time Date host name category | rename host as Server name as Name category as Category</P> Mon, 28 Sep 2020 12:58:48 GMT https://community.splunk.com/t5/Splunk-Search/Timeformat-not-sorting-properly/m-p/66237#M16440 quatral 2020-09-28T12:58:48Z https://community.splunk.com/t5/Splunk-Search/Timeformat-not-sorting-properly/m-p/66238#M16441 <P>this works for | sort Time |<BR /> it does not work for | sort - Time |</P> <P>I can use it though. please put it in as an answer so I can give you credit for the answer</P> Mon, 17 Dec 2012 20:42:11 GMT https://community.splunk.com/t5/Splunk-Search/Timeformat-not-sorting-properly/m-p/66238#M16441 hartfoml 2012-12-17T20:42:11Z https://community.splunk.com/t5/Splunk-Search/Timeformat-not-sorting-properly/m-p/66239#M16442 <P>Nope sorry this does not work in the search. Thanks</P> Mon, 17 Dec 2012 20:46:57 GMT https://community.splunk.com/t5/Splunk-Search/Timeformat-not-sorting-properly/m-p/66239#M16442 hartfoml 2012-12-17T20:46:57Z https://community.splunk.com/t5/Splunk-Search/Timeformat-not-sorting-properly/m-p/66240#M16443 <P>I figured it out. Timestamps is just a number before you convert the format so it sorts correctly so you need to sort t=he time before you convert the format like this.</P> <P>sourcetype="foo" name="foobar*" | sort - _time | convert timeformat="%m/%d/%Y - %a" ctime(_time) AS Date | convert timeformat="%H:%M:%S.%N" ctime(_time) AS Time | table Time Date host name category | rename host as Server name as Name category as Category </P> Mon, 28 Sep 2020 12:58:50 GMT https://community.splunk.com/t5/Splunk-Search/Timeformat-not-sorting-properly/m-p/66240#M16443 hartfoml 2020-09-28T12:58:50Z