Can someone help me fix my search that uses the sort command?

[mitchellthom]

I'm getting strange behavior with a sort, and wondered if anyone knows why. If I run:

index=os source=/var/log/sla/sla.log
| table SLATime, SLAState
| sort - SLATime

I get a result set sorted by time as I would expect. If I run:

index=os source=/var/log/sla/sla.log
| table SLATime, SLAState
| search SLAState=DOWN

I get all of my down results as I would expect. If I run:

index=os source=/var/log/sla/sla.log
| table SLATime, SLAState
| sort - SLATime
| search SLAState=DOWN

I get no results. So, I exported the results from the sort (without the search) to a CSV, and sure enough there were no events with a DOWN state in them. My DOWN states do contain the SLAState, and it is the same as other states. Why would sort be causing SLAState to no longer have down results?

[mitchellthom · Accepted solution]

Thanks, I just found my issue. It looks like sort is limiting the result set to the first 10,000 rows. And the first DOWN event wasn't until below that. So the search would fail.

[richgalloway]

It may not help, but the search command should be part of your base search (index=os source=/var/log/sla/sla.log SLAState=DOWN). The search will perform better and you don't have to worry about side effects of other commands.