Manipulate results without re-running search

[thepocketwade]

I just ran a search that returned approximately 1 million results. Only after it completed (which took a bit longer than I'd anticipated), did I realize that I wanted the results sorted differently. So when I went to reverse the results (actually added a '-' to my sort) Splunk reran the search. The events have already been found, is there anyway to reverse/reorder them in place without rerunning the whole search?

[Brian_Osburn · Accepted solution]

You can click on the field you want sort by in the results - not sure if that's what you were looking for.

[thepocketwade]

oh, sure enough. I've never noticed that before.