Splunk Search

Is there a difference in efficiency between this sort and reverse?

Builder

Delta cites an example using sort - _time.

Is there a difference in efficiency between this sort and reverse?

1 Solution

Esteemed Legend

Using reverse should be much more effiicient because it just rewrites the list whereas sort must continuously compare values. It should be sort 0 + _time.

View solution in original post

0 Karma

Builder

If you look into the job inspector, you should be able to see the runtime and other diagnostic information for your case as well!

0 Karma

Ultra Champion

When I examine it, sort takes more time.

Also, reverse is a command that reverses the log order, so if the time series is disjoint, reverse it.
This is also different from sort .

0 Karma

Esteemed Legend

Using reverse should be much more effiicient because it just rewrites the list whereas sort must continuously compare values. It should be sort 0 + _time.

View solution in original post

0 Karma