Getting Data In

How to sort the output baed on time and host?

shahhe
Explorer

How can I order the results by time (_time + _subsecond fields) and then by host field?

Thanks.

Tags (3)
0 Karma

shahhe
Explorer

I could not figure out how to markdown text in the comments, so I am posting my script as an answer.

Here is the python script

import time
import string
import splunk 
import splunk.auth 
import splunk.search

searchQuery = r"search sourcetype=retrans daysago=1 WARNING | sort _time"
splunk.mergeHostPath('splunkserv:8089', True) 
key = splunk.auth.getSessionKey('user','passwd') 
job = splunk.search.dispatch(searchQuery) 

while not job.isDone: 
time.sleep(1) 

for x in job.events: 
   print x.fields 

job.cancel()
0 Karma

Paolo_Prigione
Builder

Try appending this to your search string:

| sort -_time +host

Which will sort in descending time order, then ascending host order

0 Karma

shahhe
Explorer

sourcetype="retrans" daysago="1" WARNING | sort _time

This query works from the web interface, but not from my python script.

0 Karma

Paolo_Prigione
Builder

Could you post your complete search string?

0 Karma

shahhe
Explorer

I also tried '| sort _time' and I get no results.

0 Karma

shahhe
Explorer

Thanks for the answer.
This query returns rows in descending order.
How do I sort in ascending order by time?
When I use +_time I get nothing.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...