How to sort values(_time)?

[klischatb]

Hello everyone!

i have the following search:

index="xyz" "restart"
| eval _time = strftime(_time,"%F %H:%M:%S")
| stats count as "count_of_starts" values(_time) as "restart_time" by host

now i get a table with the "host" "count_of_starts" "restart_time", but the time inside values is ordered like:

2022-09-22 12:19:22

2022-09-22 12:19:46

2022-09-22 15:02:12

2022-09-22 15:02:36

2022-09-23 11:00:51

2022-09-23 11:01:16

2022-09-23 15:18:10

2022-09-23 15:18:34

2022-09-23 15:35:47

2022-09-23 15:36:11

2022-09-23 16:15:05

2022-09-23 16:15:30

2022-09-24 09:47:43

2022-09-24 09:48:06

I need this results but in opposite order, how can i implement this?

|sort - _time before or after stats doesn´t worked and | sort restart_time also didn´t affect the results.

Thank you all in advance!
Kind regards
Ben

[johnhuang]

Consider using list instead of values if appropriate. List will keep the original order of events returned. 

index="xyz" "restart"
| eval _time = strftime(_time,"%F %H:%M:%S")
| stats count as "count_of_starts" list(_time) as "restart_time" by host

The caveat of using list is that it does not dedup. If dupes are a problem, you can dedup after:

| eval restart_time=MVDEDUP(restart_time)

If your data is not chronologically sorted, you could add

| sort 0 -_time

[vinod743374]

@klischatb 

Please try like ,

What ever the time you wanna sort, just Convert that time into "epoch",
then you Can Sort that new field Consists of epoch time. 

Thankyou.

[yuanliu · Accepted solution]

If you are sure you want "restart_time" as a multivalue field, you can do

| eval i = mvrange(0, count_of_starts)
| eval restart_time = mvmap(i, mvindex(resart_time, count_of_starts - i))

[isoutamo]

Hi

as stats values creates a multivalve field for that restart_time you must use mvsort to this field.

https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchReference/MultivalueEvalFunctions#mvsort.28...

r. Ismo