Splunk sorting on Index time of splunk

[viverma5]

Hi ,

I am trying to search a string which I want to be sorted on the basis of Splunk index time , which is very useful to me. I have noticed that I am not getting any proper order when I am using _indextime as my sorting field. However, it works fine for _time

My search string is :

sourcetype=wineventlog:application | sort 500000+_indextime

[aweitzman]

You need a space between the number and the field ( sort 500000 +_indextime ), but otherwise that should work. What leads you to believe that it's not?

Try creating another field with the same data by appending | eval itime=_indextime to the end of your search and then selecting itime as a field you want to see under the results. That will make it easier to see whether it's working for you or not.