Getting Data In

How to sort the output baed on time and host?

shahhe
Explorer

How can I order the results by time (_time + _subsecond fields) and then by host field?

Thanks.

Tags (3)
0 Karma

shahhe
Explorer

I could not figure out how to markdown text in the comments, so I am posting my script as an answer.

Here is the python script

import time
import string
import splunk 
import splunk.auth 
import splunk.search

searchQuery = r"search sourcetype=retrans daysago=1 WARNING | sort _time"
splunk.mergeHostPath('splunkserv:8089', True) 
key = splunk.auth.getSessionKey('user','passwd') 
job = splunk.search.dispatch(searchQuery) 

while not job.isDone: 
time.sleep(1) 

for x in job.events: 
   print x.fields 

job.cancel()
0 Karma

Paolo_Prigione
Builder

Try appending this to your search string:

| sort -_time +host

Which will sort in descending time order, then ascending host order

0 Karma

shahhe
Explorer

sourcetype="retrans" daysago="1" WARNING | sort _time

This query works from the web interface, but not from my python script.

0 Karma

Paolo_Prigione
Builder

Could you post your complete search string?

0 Karma

shahhe
Explorer

I also tried '| sort _time' and I get no results.

0 Karma

shahhe
Explorer

Thanks for the answer.
This query returns rows in descending order.
How do I sort in ascending order by time?
When I use +_time I get nothing.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...