I've built a search form using basic XML, which displays results in a few different ways, among others a results table. I would like to be able to use this form as a real-time dashboard, which works just fine except for that the events in the results table will be displayed as oldest first. Using
reverse fixes that in the real-time case, however that has the undesired effect on non-real-time searches that events are displayed in oldest-to-newest order instead. I also understand using
reverse has a considerable impact on performance.
Is there a way to have the results table always show newest events first, either using simple or advanced XML?
This will sort the events/results in descending order of their time:
... | sort -_time
where as this one would sort them in descending order of the time they have been indexed:
... | sort -_indextime
can you post the search you're using? I believe the SimpleResultsTable has code that attempts to show newest first even in real time search cases, and I suspect that somehow this default behavior is being subtly defeated.
The search itself is very simple. It uses a searchTemplate with the search 'sourcetype="squid" clientip="$clientip$" urihost="$urihost$"' and a searchPostProcess 'sort -_time'. The post processing made it work the way I wanted.