Splunk Search

How to write a search to sort data in order it was present in the source file?

karanoshan
New Member

I am working with Splunk for the first time and I am using this data:

74.125.19.106 - - [03/Aug/2015:18:27:48] "GET /product.screen?productId=FS-SG-G03&JSESSIONID=SD10SL4FF4ADFF4976 HTTP 1.1" 200 3770 "http://www.buttercupgames.com/category.screen?categoryId=STRATEGY" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5" 667
74.125.19.106 - - [03/Aug/2015:18:27:50] "POST /cart.do?action=addtocart&itemId=EST-26&productId=FS-SG-G03&JSESSIONID=SD10SL4FF4ADFF4976 HTTP 1.1" 200 293 "http://www.buttercupgames.com/product.screen?productId=FS-SG-G03" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5" 100
74.125.19.106 - - [03/Aug/2015:18:27:50] "POST /cart.do?action=purchase&itemId=EST-26&JSESSIONID=SD10SL4FF4ADFF4976 HTTP 1.1" 200 2051 "http://www.buttercupgames.com/cart.do?action=addtocart&itemId=EST-26&categoryId=STRATEGY&productId=FS-SG-G03" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5" 871
74.125.19.106 - - [03/Aug/2015:18:27:51] "POST /cart/error.do?msg=CreditDoesNotMatch&JSESSIONID=SD10SL4FF4ADFF4976 HTTP 1.1" 200 2934 "http://www.buttercupgames.com/cart.do?action=purchase&itemId=EST-26" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5" 866
74.125.19.106 - - [03/Aug/2015:18:27:48] "GET /product.screen?productId=WC-SH-G04&JSESSIONID=SD10SL4FF4ADFF4976 HTTP 1.1" 200 1705 "http://www.buttercupgames.com/category.screen?categoryId=SHOOTER" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5" 160
74.125.19.106 - - [03/Aug/2015:18:27:50] "POST /cart.do?action=addtocart&itemId=EST-18&productId=WC-SH-G04&JSESSIONID=SD10SL4FF4ADFF4976 HTTP 1.1" 200 2537 "http://www.buttercupgames.com/product.screen?productId=WC-SH-G04" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5" 434

I want the output in the same order as it was present in the original file, however, I am not able to get it using any sorting options.

Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

A basic search without a sort command will return the events as they were indexed, but with the newest first. To see them oldest first, use the reverse command. You can also use sort _time.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...