How to reverse the order of displayed events?

[the_wolverine]

Got this question today from someone who needs to reverse the order of the search results for their troubleshooting purposes.

[the_wolverine]

By default, Splunk displays your search results from most recent to oldest. You can reverse the order by appending your search with '| reverse'. For example:

sourcetype=foo | reverse

[HeinzWaescher]

Hi,

thanks for your explanation! Then the " | reverse " function will fit my needs in most of the cases.

[sowings]

Try it. You'll find that sort - _time doesn't deal with events that have the same time stamp in the same way as reverse. Reverse literally flips the event stream top to bottom, but the sort might leave "simultaneous" events in the original "new stuff on top" order. This is probably only meaningful if you have an event stream that is part of a transaction, and you're used to reading it in "log" order.

[HeinzWaescher]

Hi,

what is the difference between " | reverse " and "| sort - _time " ? I would expect the same effect?

[jrodman]

Note that this reversal is not free. For smaller numbers of events, it will be totally fine. For millions of events it is some significant amount of work.