*Working:
base: ... | sort - first_login_epoch
post: | table first_login_epoch
*Not working
base: ... | sort first_login_epoch
post: | table first_login_epoch
*Working:
base: ...
post: | sort - first_login_epoch | table first_login_epoch
*Working:
base: ...
post: | sort first_login_epoch | table first_login_epoch
Zero clue what is going on here. This MUST be a bug, right? By not working I mean it doesn't sort. The only code missing here is represented by ...
. Converting to num or adding sort 0 doesn't change anything.
@nick405060 if you are using post-processing its ideal use case is not that you send raw data to your post-process searches and use the table command. Are you interested only in first_login_epoch field? What is the use case? Also what is the need of post processing?
I needed to use post-processing as I had the same base for multiple post-process searches. Also I have tokens linked to dynamic inputs (e.g. time picker) that are used in the post-process searches, so time complexity. I am not only interested in first_login_epoch, but edited my code during debugging to be exactly what is represented here. Reverse sort in base honored, regular sort in base not honored, reverse sort outside of base honored, regular sort outside of base honored.