topic Re: sorting date in Splunk Search

sorting date

srajanbabu — Mon, 28 Sep 2020 15:02:58 GMT

I have a query as source="C:\Data\acctdata\snm4-logger.log" "Customer has successfully retrieved file"| rex "::\s(?\S+)\s"| rex "^\S+\s(?\S+)." | rex "\s(?\S+)\s((?\d+)\srecords/(?\d+)\sbytes)$"| stats count sum(record_count) as RecordCount sum(byte_count) as ByteCount by timestamp userid .I want to sort the timestamp in descending order
so that result would be

userid RecordCount ByteCount timestamp

AAMG1FBY 3105 1586745 05/03/13
AAMG1SBY 3129 1597053 04/03/13

Re: sorting date

polymorphic — Wed, 23 Oct 2013 11:11:51 GMT

You should be able to do:
| sort -timestamp

Re: sorting date

Ayn — Wed, 23 Oct 2013 11:12:14 GMT

Uh well, sort? http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Sort

source="C:\\Data\\acctdata\\snm4-logger.log" "Customer has successfully retrieved file"| rex "::\s(?<timestamp>\S+)\s"| rex "^\S+\s(?<userid>\S+)\." | rex "\s(?<file_name>\S+)\s\((?<record_count>\d+)\srecords/(?<byte_count>\d+)\sbytes\)$"| stats count  sum(record_count) as RecordCount sum(byte_count) as ByteCount by timestamp userid | sort - timestamp