Splunk Search

Reverse sorts are honored and regular sorts are not honored in a base search?

nick405060
Motivator
*Working:
base: ... | sort - first_login_epoch
post: | table first_login_epoch

*Not working
base: ... | sort first_login_epoch
post: | table first_login_epoch

*Working:
base: ...
post: | sort - first_login_epoch | table first_login_epoch

*Working:
base: ...
post: | sort first_login_epoch | table first_login_epoch

Zero clue what is going on here. This MUST be a bug, right? By not working I mean it doesn't sort. The only code missing here is represented by .... Converting to num or adding sort 0 doesn't change anything.

0 Karma

niketn
Legend

@nick405060 if you are using post-processing its ideal use case is not that you send raw data to your post-process searches and use the table command. Are you interested only in first_login_epoch field? What is the use case? Also what is the need of post processing?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

nick405060
Motivator

I needed to use post-processing as I had the same base for multiple post-process searches. Also I have tokens linked to dynamic inputs (e.g. time picker) that are used in the post-process searches, so time complexity. I am not only interested in first_login_epoch, but edited my code during debugging to be exactly what is represented here. Reverse sort in base honored, regular sort in base not honored, reverse sort outside of base honored, regular sort outside of base honored.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...