Splunk Search
Highlighted

Manipulate results without re-running search

Path Finder

I just ran a search that returned approximately 1 million results. Only after it completed (which took a bit longer than I'd anticipated), did I realize that I wanted the results sorted differently. So when I went to reverse the results (actually added a '-' to my sort) Splunk reran the search. The events have already been found, is there anyway to reverse/reorder them in place without rerunning the whole search?

Highlighted

Re: Manipulate results without re-running search

Builder

You can click on the field you want sort by in the results - not sure if that's what you were looking for.

View solution in original post

Highlighted

Re: Manipulate results without re-running search

Path Finder

oh, sure enough. I've never noticed that before.

0 Karma