When I change the time format from default e.g. 2020-05-08 19:46:20 to this :08/05/20 19:46:20 by the use this conversion command: | eval _time=strftime(_time,"%d/%m/%y %H:%M:%S") the sort function does not work.
To overcome this, I can put the sort command e.g. " | sort -_time " prior eval command but this does not resolve the main Splunk build in feature .i. e. arrows up and down next to the table headers.
Since I changed the time output format the sort will work only on one page with results, if there are multiple pages with results, this will not work, is this normal?