Splunk Search

How to reverse the order of displayed events?

the_wolverine
Champion

Got this question today from someone who needs to reverse the order of the search results for their troubleshooting purposes.

Tags (1)

the_wolverine
Champion

By default, Splunk displays your search results from most recent to oldest. You can reverse the order by appending your search with '| reverse'. For example:

sourcetype=foo | reverse

HeinzWaescher
Motivator

Hi,

thanks for your explanation! Then the " | reverse " function will fit my needs in most of the cases.

0 Karma

sowings
Splunk Employee
Splunk Employee

Try it. You'll find that sort - _time doesn't deal with events that have the same time stamp in the same way as reverse. Reverse literally flips the event stream top to bottom, but the sort might leave "simultaneous" events in the original "new stuff on top" order. This is probably only meaningful if you have an event stream that is part of a transaction, and you're used to reading it in "log" order.

HeinzWaescher
Motivator

Hi,

what is the difference between " | reverse " and "| sort - _time " ? I would expect the same effect?

0 Karma

jrodman
Splunk Employee
Splunk Employee

Note that this reversal is not free. For smaller numbers of events, it will be totally fine. For millions of events it is some significant amount of work.

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...