Getting Data In

How to sort the contents of a list by timestamp

whydoineedtoreg
New Member

I'm currently querying

source="log" | stats list by Id

Which gives me nicely grouped data.

However I would like the content of those groups sorted by Timestamp.
That is to say I do not want the groups themselves sorted but the records inside each group.

0 Karma
1 Solution

somesoni2
Revered Legend

Right now they will sorted in reverse-chronological/descending order of timestamp (_time field). Do you want to sort in ascending/chronological order? If yes, try like this

source="log" | reverse | stats list by Id

View solution in original post

somesoni2
Revered Legend

Right now they will sorted in reverse-chronological/descending order of timestamp (_time field). Do you want to sort in ascending/chronological order? If yes, try like this

source="log" | reverse | stats list by Id
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...