Splunk Search

How to write a search to sort data in order it was present in the source file?

karanoshan
New Member

I am working with Splunk for the first time and I am using this data:

74.125.19.106 - - [03/Aug/2015:18:27:48] "GET /product.screen?productId=FS-SG-G03&JSESSIONID=SD10SL4FF4ADFF4976 HTTP 1.1" 200 3770 "http://www.buttercupgames.com/category.screen?categoryId=STRATEGY" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5" 667
74.125.19.106 - - [03/Aug/2015:18:27:50] "POST /cart.do?action=addtocart&itemId=EST-26&productId=FS-SG-G03&JSESSIONID=SD10SL4FF4ADFF4976 HTTP 1.1" 200 293 "http://www.buttercupgames.com/product.screen?productId=FS-SG-G03" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5" 100
74.125.19.106 - - [03/Aug/2015:18:27:50] "POST /cart.do?action=purchase&itemId=EST-26&JSESSIONID=SD10SL4FF4ADFF4976 HTTP 1.1" 200 2051 "http://www.buttercupgames.com/cart.do?action=addtocart&itemId=EST-26&categoryId=STRATEGY&productId=FS-SG-G03" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5" 871
74.125.19.106 - - [03/Aug/2015:18:27:51] "POST /cart/error.do?msg=CreditDoesNotMatch&JSESSIONID=SD10SL4FF4ADFF4976 HTTP 1.1" 200 2934 "http://www.buttercupgames.com/cart.do?action=purchase&itemId=EST-26" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5" 866
74.125.19.106 - - [03/Aug/2015:18:27:48] "GET /product.screen?productId=WC-SH-G04&JSESSIONID=SD10SL4FF4ADFF4976 HTTP 1.1" 200 1705 "http://www.buttercupgames.com/category.screen?categoryId=SHOOTER" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5" 160
74.125.19.106 - - [03/Aug/2015:18:27:50] "POST /cart.do?action=addtocart&itemId=EST-18&productId=WC-SH-G04&JSESSIONID=SD10SL4FF4ADFF4976 HTTP 1.1" 200 2537 "http://www.buttercupgames.com/product.screen?productId=WC-SH-G04" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5" 434

I want the output in the same order as it was present in the original file, however, I am not able to get it using any sorting options.

Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

A basic search without a sort command will return the events as they were indexed, but with the newest first. To see them oldest first, use the reverse command. You can also use sort _time.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Fall Into Learning with New Splunk Education Courses

Every month, Splunk Education releases new courses to help you branch out, strengthen your data science roots, ...

Super Optimize your Splunk Stats Searches: Unlocking the Power of tstats, TERM, and ...

By Martin Hettervik, Senior Consultant and Team Leader at Accelerate at Iver, Splunk MVPThe stats command is ...

How Splunk Observability Cloud Prevented a Major Payment Crisis in Minutes

Your bank's payment processing system is humming along during a busy afternoon, handling millions in hourly ...