Splunk Search

Splunk sorting on Index time of splunk

viverma5
Explorer

Hi ,

I am trying to search a string which I want to be sorted on the basis of Splunk index time , which is very useful to me. I have noticed that I am not getting any proper order when I am using _indextime as my sorting field. However, it works fine for _time

My search string is :

sourcetype=wineventlog:application | sort 500000+_indextime

Tags (1)
0 Karma

aweitzman
Motivator

You need a space between the number and the field ( sort 500000 +_indextime ), but otherwise that should work. What leads you to believe that it's not?

Try creating another field with the same data by appending | eval itime=_indextime to the end of your search and then selecting itime as a field you want to see under the results. That will make it easier to see whether it's working for you or not.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...