Splunk Search

Reverse sorts are honored and regular sorts are not honored in a base search?

nick405060
Motivator
*Working:
base: ... | sort - first_login_epoch
post: | table first_login_epoch

*Not working
base: ... | sort first_login_epoch
post: | table first_login_epoch

*Working:
base: ...
post: | sort - first_login_epoch | table first_login_epoch

*Working:
base: ...
post: | sort first_login_epoch | table first_login_epoch

Zero clue what is going on here. This MUST be a bug, right? By not working I mean it doesn't sort. The only code missing here is represented by .... Converting to num or adding sort 0 doesn't change anything.

0 Karma

niketn
Legend

@nick405060 if you are using post-processing its ideal use case is not that you send raw data to your post-process searches and use the table command. Are you interested only in first_login_epoch field? What is the use case? Also what is the need of post processing?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

nick405060
Motivator

I needed to use post-processing as I had the same base for multiple post-process searches. Also I have tokens linked to dynamic inputs (e.g. time picker) that are used in the post-process searches, so time complexity. I am not only interested in first_login_epoch, but edited my code during debugging to be exactly what is represented here. Reverse sort in base honored, regular sort in base not honored, reverse sort outside of base honored, regular sort outside of base honored.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...