Archive

How to reverse the order of displayed events?

Champion

Got this question today from someone who needs to reverse the order of the search results for their troubleshooting purposes.

Tags (1)

Champion

By default, Splunk displays your search results from most recent to oldest. You can reverse the order by appending your search with '| reverse'. For example:

sourcetype=foo | reverse

Motivator

Hi,

thanks for your explanation! Then the " | reverse " function will fit my needs in most of the cases.

0 Karma

Splunk Employee
Splunk Employee

Try it. You'll find that sort - _time doesn't deal with events that have the same time stamp in the same way as reverse. Reverse literally flips the event stream top to bottom, but the sort might leave "simultaneous" events in the original "new stuff on top" order. This is probably only meaningful if you have an event stream that is part of a transaction, and you're used to reading it in "log" order.

Motivator

Hi,

what is the difference between " | reverse " and "| sort - _time " ? I would expect the same effect?

0 Karma

Splunk Employee
Splunk Employee

Note that this reversal is not free. For smaller numbers of events, it will be totally fine. For millions of events it is some significant amount of work.