Splunk Search

Splunk sorting on Index time of splunk

viverma5
Explorer

Hi ,

I am trying to search a string which I want to be sorted on the basis of Splunk index time , which is very useful to me. I have noticed that I am not getting any proper order when I am using _indextime as my sorting field. However, it works fine for _time

My search string is :

sourcetype=wineventlog:application | sort 500000+_indextime

Tags (1)
0 Karma

aweitzman
Motivator

You need a space between the number and the field ( sort 500000 +_indextime ), but otherwise that should work. What leads you to believe that it's not?

Try creating another field with the same data by appending | eval itime=_indextime to the end of your search and then selecting itime as a field you want to see under the results. That will make it easier to see whether it's working for you or not.

0 Karma
Get Updates on the Splunk Community!

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...