Splunk Search

Date sorting

iamniks
Explorer

Can you please tell how to sort date values ?

Tags (2)
0 Karma

MHibbin
Influencer

You could try

*|sort -_time

Or do you have a unique date value. If its already extracted you could do something like

*|sort -<date_field>

you may need to convert it to epoch time, if you are having issues.

0 Karma

Ayn
Legend

Provide more information on your problem please.

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Observability - October 2025

What’s New?    We’re excited to announce the latest enhancements to Splunk Observability Cloud and share ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

&#x1f5e3; You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...