topic Sort 0 -_time in Splunk Search

Sort 0 -_time

IRHM73 — Thu, 27 Aug 2015 06:34:11 GMT

Hi, I wonder whether someone could help me please.

I've inherited a search with the line sort 0 detail.ref,-_time.

From the Splunk documentation, I know that sort 1 -_time means 'return the more recent event', but could someone explain to me please what the zero means. My thought was that the line meant 'don't return the most recent event'.

Could someone possibly confirm for me please whether this assumption is correct.

Many thanks and kind regards

Chris

Re: Sort 0 -_time

chanmi2 — Thu, 27 Aug 2015 07:14:23 GMT

sort 0 means no limit and returns all result
Please read the docs
http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Sort

If you want the oldest result, you may try

sort 1 _time

without the minus sign, it will sort in ascending order

Re: Sort 0 -_time

IRHM73 — Thu, 27 Aug 2015 07:18:47 GMT

@chanmi2 Thank you very much for taking the time to reply to my post and for the guidance.

Kind Regards

Chris