Splunk Search

How to write a search to sort data in order it was present in the source file?

karanoshan
New Member

I am working with Splunk for the first time and I am using this data:

74.125.19.106 - - [03/Aug/2015:18:27:48] "GET /product.screen?productId=FS-SG-G03&JSESSIONID=SD10SL4FF4ADFF4976 HTTP 1.1" 200 3770 "http://www.buttercupgames.com/category.screen?categoryId=STRATEGY" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5" 667
74.125.19.106 - - [03/Aug/2015:18:27:50] "POST /cart.do?action=addtocart&itemId=EST-26&productId=FS-SG-G03&JSESSIONID=SD10SL4FF4ADFF4976 HTTP 1.1" 200 293 "http://www.buttercupgames.com/product.screen?productId=FS-SG-G03" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5" 100
74.125.19.106 - - [03/Aug/2015:18:27:50] "POST /cart.do?action=purchase&itemId=EST-26&JSESSIONID=SD10SL4FF4ADFF4976 HTTP 1.1" 200 2051 "http://www.buttercupgames.com/cart.do?action=addtocart&itemId=EST-26&categoryId=STRATEGY&productId=FS-SG-G03" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5" 871
74.125.19.106 - - [03/Aug/2015:18:27:51] "POST /cart/error.do?msg=CreditDoesNotMatch&JSESSIONID=SD10SL4FF4ADFF4976 HTTP 1.1" 200 2934 "http://www.buttercupgames.com/cart.do?action=purchase&itemId=EST-26" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5" 866
74.125.19.106 - - [03/Aug/2015:18:27:48] "GET /product.screen?productId=WC-SH-G04&JSESSIONID=SD10SL4FF4ADFF4976 HTTP 1.1" 200 1705 "http://www.buttercupgames.com/category.screen?categoryId=SHOOTER" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5" 160
74.125.19.106 - - [03/Aug/2015:18:27:50] "POST /cart.do?action=addtocart&itemId=EST-18&productId=WC-SH-G04&JSESSIONID=SD10SL4FF4ADFF4976 HTTP 1.1" 200 2537 "http://www.buttercupgames.com/product.screen?productId=WC-SH-G04" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5" 434

I want the output in the same order as it was present in the original file, however, I am not able to get it using any sorting options.

Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

A basic search without a sort command will return the events as they were indexed, but with the newest first. To see them oldest first, use the reverse command. You can also use sort _time.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...