Splunk Search

changing the sort order of _time from a streamstats output

dang
Path Finder

I'm attempting to figure out the average reboot times of a server with the following search:

index=main host=MYSERVER source=WinEventLog:System (EventCode="6006" OR EventCode="6005")  | transaction host startswith=6006 endswith=6005 maxevents=2  | table host duration _time| streamstats avg(duration) as stream | eval average=round(stream,2) | fields - stream | convert timeformat=%M:%S ctime(duration)  | convert timeformat=%M:%S ctime(average)

Everything works as expected, except I can't seem to properly reverse the sort order of the dates (technically the _time field). No matter where I add a clause of | sort - _time) | I can't seem to get the data to sort the way I want, which is to have the earliest date at the top, and the latest (most current) date at the bottom of the list. Even evaling _time to another name did not seem to help. I'm unsure what I'm doing wrong here.

I'm using version 5.0.3, build 163460, if that helps. Any suggestions?

1 Solution

antlefebvre
Communicator

You'll want to do |sort +_time as that will sort with the earliest time first. Just ran your search in my environment to confirm. Very handy search.

View solution in original post

antlefebvre
Communicator

You'll want to do |sort +_time as that will sort with the earliest time first. Just ran your search in my environment to confirm. Very handy search.

dang
Path Finder

That did it. Thanks antlefebvre

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...