how to make the search in ascending order?

[sajoseph]

HI ,
I have a log file where it has a sequence of activity of users. I am trying to parse that log.
Splunk is parsing the log with respect to the time in the descending order. (meaning it startes parsing from the latest time to old time).

For my condition, after I index the log and work on search for a particular user, it is exactly in the reverse order in time than it is supposed to be.

Exmplae:» 4/3/13
5:00:21.000 AM

SNM4 FISGMEFX.524F :: 04/03/13 05:00:21 :: Processing complete
host=WTPCPAPPKD01 Options| sourcetype=SNM4 Options| source=D:\SPLUNK Data\snm4-logger.log Options| user=FISGMEFX Options
24 » 4/3/13
5:00:21.000 AM

SNM4 FISGMEFX.524F :: 04/03/13 05:00:21 :: ERROR No activity was produced by this user session
host=WTPCPAPPKD01 Options| sourcetype=SNM4 Options| source=D:\SPLUNK Data\snm4-logger.log Options| user=FISGMEFX Options
25 » 4/3/13
5:00:21.000 AM

SNM4 FISGMEFX.524F :: 04/03/13 05:00:21 :: Remote IP address was 166.73.20.25
host=WTPCPAPPKD01 Options| sourcetype=SNM4 Options| source=D:\SPLUNK Data\snm4-logger.log Options| user=FISGMEFX Options
26 » 4/3/13
5:00:21.000 AM

SNM4 FISGMEFX.524F :: 04/03/13 05:00:21 :: User logged off, Processing will begin
host=WTPCPAPPKD01 Options| sourcetype=SNM4 Options| source=D:\SPLUNK Data\snm4-logger.log Options| user=FISGMEFX Options
27 » 4/3/13
5:00:21.000 AM

SNM4 FISGMEFX.#### :: 04/03/13 05:00:21 :: User fisgmefx logged in
host=WTPCPAPPKD01 Options| sourcetype=SNM4 Options| source=D:\SPLUNK Data\snm4-logger.log Options| user=FISGMEFX Options

CAn somebody help how to approach this prob? I need to sort the search in the ascending order of time.

Appreciate yuor response.

[jkilgrow]

Yeah... reverse works, but it is very, very slow. Beware...

[to4kawa]

| reverse is faster than | sort 0 - _time
@jkilgrow
I think reverse is not slow and the slow query is because the search query is not optimized.

[_d_]

Well, the way Splunk works on, produces and displays search results is in reverse time order. That is, the latest events/results show up first - or on top of the list.
To reverse this order, use the reverse command. But note, that this only changes the way the events/results are displayed - it does not change the way the results/events are searched and generated.

Ex.

index=my_index sourcetype=my_sourcetype earliest=-5m | reverse