Sort 0 -_time

[IRHM73]

Hi, I wonder whether someone could help me please.

I've inherited a search with the line sort 0 detail.ref,-_time.

From the Splunk documentation, I know that sort 1 -_time means 'return the more recent event', but could someone explain to me please what the zero means. My thought was that the line meant 'don't return the most recent event'.

Could someone possibly confirm for me please whether this assumption is correct.

Many thanks and kind regards

Chris

[chanmi2 · Accepted solution]

sort 0 means no limit and returns all result
Please read the docs
http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Sort

If you want the oldest result, you may try

sort 1 _time

without the minus sign, it will sort in ascending order

[IRHM73]

@chanmi2 Thank you very much for taking the time to reply to my post and for the guidance.

Kind Regards

Chris