Splunk Search

Can someone help me fix my search that uses the sort command?

mitchellthom
Engager

I'm getting strange behavior with a sort, and wondered if anyone knows why. If I run:

index=os source=/var/log/sla/sla.log
| table SLATime, SLAState
| sort - SLATime

I get a result set sorted by time as I would expect. If I run:

index=os source=/var/log/sla/sla.log
| table SLATime, SLAState
| search SLAState=DOWN

I get all of my down results as I would expect. If I run:

index=os source=/var/log/sla/sla.log
| table SLATime, SLAState
| sort - SLATime
| search SLAState=DOWN

I get no results. So, I exported the results from the sort (without the search) to a CSV, and sure enough there were no events with a DOWN state in them. My DOWN states do contain the SLAState, and it is the same as other states. Why would sort be causing SLAState to no longer have down results?

0 Karma
1 Solution

mitchellthom
Engager

Thanks, I just found my issue. It looks like sort is limiting the result set to the first 10,000 rows. And the first DOWN event wasn't until below that. So the search would fail.

View solution in original post

0 Karma

mitchellthom
Engager

Thanks, I just found my issue. It looks like sort is limiting the result set to the first 10,000 rows. And the first DOWN event wasn't until below that. So the search would fail.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It may not help, but the search command should be part of your base search (index=os source=/var/log/sla/sla.log SLAState=DOWN). The search will perform better and you don't have to worry about side effects of other commands.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...