Splunk Search

How to write a search to sort data in order it was present in the source file?

karanoshan
New Member

I am working with Splunk for the first time and I am using this data:

74.125.19.106 - - [03/Aug/2015:18:27:48] "GET /product.screen?productId=FS-SG-G03&JSESSIONID=SD10SL4FF4ADFF4976 HTTP 1.1" 200 3770 "http://www.buttercupgames.com/category.screen?categoryId=STRATEGY" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5" 667
74.125.19.106 - - [03/Aug/2015:18:27:50] "POST /cart.do?action=addtocart&itemId=EST-26&productId=FS-SG-G03&JSESSIONID=SD10SL4FF4ADFF4976 HTTP 1.1" 200 293 "http://www.buttercupgames.com/product.screen?productId=FS-SG-G03" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5" 100
74.125.19.106 - - [03/Aug/2015:18:27:50] "POST /cart.do?action=purchase&itemId=EST-26&JSESSIONID=SD10SL4FF4ADFF4976 HTTP 1.1" 200 2051 "http://www.buttercupgames.com/cart.do?action=addtocart&itemId=EST-26&categoryId=STRATEGY&productId=FS-SG-G03" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5" 871
74.125.19.106 - - [03/Aug/2015:18:27:51] "POST /cart/error.do?msg=CreditDoesNotMatch&JSESSIONID=SD10SL4FF4ADFF4976 HTTP 1.1" 200 2934 "http://www.buttercupgames.com/cart.do?action=purchase&itemId=EST-26" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5" 866
74.125.19.106 - - [03/Aug/2015:18:27:48] "GET /product.screen?productId=WC-SH-G04&JSESSIONID=SD10SL4FF4ADFF4976 HTTP 1.1" 200 1705 "http://www.buttercupgames.com/category.screen?categoryId=SHOOTER" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5" 160
74.125.19.106 - - [03/Aug/2015:18:27:50] "POST /cart.do?action=addtocart&itemId=EST-18&productId=WC-SH-G04&JSESSIONID=SD10SL4FF4ADFF4976 HTTP 1.1" 200 2537 "http://www.buttercupgames.com/product.screen?productId=WC-SH-G04" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5" 434

I want the output in the same order as it was present in the original file, however, I am not able to get it using any sorting options.

Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

A basic search without a sort command will return the events as they were indexed, but with the newest first. To see them oldest first, use the reverse command. You can also use sort _time.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...