https://community.splunk.com/t5/Splunk-Search/Sort-record-based-on-the-time-field-within-the-record-not-the/m-p/166553#M47417 <P>Thanks lguinn ...it works <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 01 Aug 2014 01:06:27 GMT ishugupta 2014-08-01T01:06:27Z https://community.splunk.com/t5/Splunk-Search/Sort-record-based-on-the-time-field-within-the-record-not-the/m-p/166551#M47415 <P>Hello,<BR /> I have my data in the below format :<BR /> 314 888 abcd 98 2013-07-09-08.01.41.00<BR /> 514 888 abcd 98 2013-07-07-08.01.42.00<BR /> 364 888 abcd 98 2013-01-02-10.01.46.00<BR /> 394 888 abcd 98 2013-07-02-11.01.48.00</P> <P>I am trying to sort my records based on the 5th column time stamp (which is not the ingestion time stamp) .<BR /> Can you please help me with it?</P> Fri, 01 Aug 2014 00:02:00 GMT https://community.splunk.com/t5/Splunk-Search/Sort-record-based-on-the-time-field-within-the-record-not-the/m-p/166551#M47415 ishugupta 2014-08-01T00:02:00Z https://community.splunk.com/t5/Splunk-Search/Sort-record-based-on-the-time-field-within-the-record-not-the/m-p/166552#M47416 <P>Hopefully, you have created the appropriate fields for your data. For the answer below, I assume that the 5th field is called <CODE>timestamp</CODE></P> <PRE><CODE>yoursearchhere | eval ts = strftime(timestamp,"%Y-%m-%d-%H.%M.%S.%2N") | sort ts </CODE></PRE> Fri, 01 Aug 2014 00:21:02 GMT https://community.splunk.com/t5/Splunk-Search/Sort-record-based-on-the-time-field-within-the-record-not-the/m-p/166552#M47416 lguinn2 2014-08-01T00:21:02Z https://community.splunk.com/t5/Splunk-Search/Sort-record-based-on-the-time-field-within-the-record-not-the/m-p/166553#M47417 <P>Thanks lguinn ...it works <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 01 Aug 2014 01:06:27 GMT https://community.splunk.com/t5/Splunk-Search/Sort-record-based-on-the-time-field-within-the-record-not-the/m-p/166553#M47417 ishugupta 2014-08-01T01:06:27Z