Splunk Search

Splunk sorting on Index time of splunk

viverma5
Explorer

Hi ,

I am trying to search a string which I want to be sorted on the basis of Splunk index time , which is very useful to me. I have noticed that I am not getting any proper order when I am using _indextime as my sorting field. However, it works fine for _time

My search string is :

sourcetype=wineventlog:application | sort 500000+_indextime

Tags (1)
0 Karma

aweitzman
Motivator

You need a space between the number and the field ( sort 500000 +_indextime ), but otherwise that should work. What leads you to believe that it's not?

Try creating another field with the same data by appending | eval itime=_indextime to the end of your search and then selecting itime as a field you want to see under the results. That will make it easier to see whether it's working for you or not.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...