Ordering Events that arrive with the same timestamp but are out of order

[x213217]

I have a few instances where I will get status events for when jobs are running very quickly and appear as the same timestamp in splunk. When this happens I will get a RUNNING status event after a SUCCESS event, which in fact should be reversed. I am doing processing to get the latest status for certain jobs and this causes a problem with that.

Here is an example below, as you see the two events have an identical timestamp but have been pulled in in reverse order. How do i properly get the latest event when the timestamp is shared like this?

[sdchakraborty]

what about sorting by index time? This is how you get index time even though your _time is same but indextime will not be same.

| eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S")
| sort - indextime

[dottey]

This did work for me. I wonder if it would "break" if we ever have to backfill data, though.

[skoelpin]

Looks like you need to add ms to your logging for better granularity and correct ordering. Your jobs are running and completing in under a second. Nothing Splunk can do to fix this

[Vijeta]

You can |sort - _time statusCode

[x213217]

Unfortunately cannot use that field to sort as for events for Starting Running & Success statuses...these have statusCodes of 3, 1, 4 respectively so the order does not match an increasing pattern

[Vijeta]

you can assign your own values, using eval and if and sort based on new field.

eval status=if(statusCode=1,P2,if(statusCode=3,P1, if(statusCode=4,P4)))