Splunk Search

Manipulate results without re-running search

thepocketwade
Path Finder

I just ran a search that returned approximately 1 million results. Only after it completed (which took a bit longer than I'd anticipated), did I realize that I wanted the results sorted differently. So when I went to reverse the results (actually added a '-' to my sort) Splunk reran the search. The events have already been found, is there anyway to reverse/reorder them in place without rerunning the whole search?

1 Solution

Brian_Osburn
Builder

You can click on the field you want sort by in the results - not sure if that's what you were looking for.

View solution in original post

Brian_Osburn
Builder

You can click on the field you want sort by in the results - not sure if that's what you were looking for.

thepocketwade
Path Finder

oh, sure enough. I've never noticed that before.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...