I'm attempting to figure out the average reboot times of a server with the following search:
index=main host=MYSERVER source=WinEventLog:System (EventCode="6006" OR EventCode="6005") | transaction host startswith=6006 endswith=6005 maxevents=2 | table host duration _time| streamstats avg(duration) as stream | eval average=round(stream,2) | fields - stream | convert timeformat=%M:%S ctime(duration) | convert timeformat=%M:%S ctime(average)
Everything works as expected, except I can't seem to properly reverse the sort order of the dates (technically the _time field). No matter where I add a clause of | sort - _time) |
I can't seem to get the data to sort the way I want, which is to have the earliest date at the top, and the latest (most current) date at the bottom of the list. Even eval
ing _time to another name did not seem to help. I'm unsure what I'm doing wrong here.
I'm using version 5.0.3, build 163460, if that helps. Any suggestions?
You'll want to do |sort +_time as that will sort with the earliest time first. Just ran your search in my environment to confirm. Very handy search.
You'll want to do |sort +_time as that will sort with the earliest time first. Just ran your search in my environment to confirm. Very handy search.
That did it. Thanks antlefebvre