Splunk Search

Splunk sort class not working with subsearch

Ranjeeth
New Member

With the below query I'm trying to sort dateTime by descending order but the sorting is not working, could someone please help me to identify the issue in the query .

 

hostname="alt*" [search "Starting Batch job" AND hostname="alt*" UUID=* | stats values(UUID) as uuid by UUID | fields UUID] | regex "JOB Execution*" |stats values(@timestamp) as dateTime,values(UUID) as uuid,values(message) as message | sort - dateTime | table dateTime, uuid, message

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your stats command as it stands returns a single row with 3 multi-value fields. If you want to be able to sort the dateTime field, you should separate it out into different rows, possibly by moving the values timestamp to a by clause

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...