Hi ,
I am trying to search a string which I want to be sorted on the basis of Splunk index time , which is very useful to me. I have noticed that I am not getting any proper order when I am using _indextime as my sorting field. However, it works fine for _time
My search string is :
sourcetype=wineventlog:application | sort 500000+_indextime
You need a space between the number and the field ( sort 500000 +_indextime
), but otherwise that should work. What leads you to believe that it's not?
Try creating another field with the same data by appending | eval itime=_indextime
to the end of your search and then selecting itime
as a field you want to see under the results. That will make it easier to see whether it's working for you or not.