Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Sort 0 -_time
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi, I wonder whether someone could help me please.
I've inherited a search with the line sort 0 detail.ref,-_time.
From the Splunk documentation, I know that sort 1 -_time means 'return the more recent event', but could someone explain to me please what the zero means. My thought was that the line meant 'don't return the most recent event'.
Could someone possibly confirm for me please whether this assumption is correct.
Many thanks and kind regards
Chris
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
sort 0 means no limit and returns all result
Please read the docs
http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Sort
If you want the oldest result, you may try
sort 1 _time
without the minus sign, it will sort in ascending order
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
sort 0 means no limit and returns all result
Please read the docs
http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Sort
If you want the oldest result, you may try
sort 1 _time
without the minus sign, it will sort in ascending order
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@chanmi2 Thank you very much for taking the time to reply to my post and for the guidance.
Kind Regards
Chris
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
