Splunk Search

changing the sort order of _time from a streamstats output

dang
Path Finder

I'm attempting to figure out the average reboot times of a server with the following search:

index=main host=MYSERVER source=WinEventLog:System (EventCode="6006" OR EventCode="6005")  | transaction host startswith=6006 endswith=6005 maxevents=2  | table host duration _time| streamstats avg(duration) as stream | eval average=round(stream,2) | fields - stream | convert timeformat=%M:%S ctime(duration)  | convert timeformat=%M:%S ctime(average)

Everything works as expected, except I can't seem to properly reverse the sort order of the dates (technically the _time field). No matter where I add a clause of | sort - _time) | I can't seem to get the data to sort the way I want, which is to have the earliest date at the top, and the latest (most current) date at the bottom of the list. Even evaling _time to another name did not seem to help. I'm unsure what I'm doing wrong here.

I'm using version 5.0.3, build 163460, if that helps. Any suggestions?

1 Solution

antlefebvre
Communicator

You'll want to do |sort +_time as that will sort with the earliest time first. Just ran your search in my environment to confirm. Very handy search.

View solution in original post

antlefebvre
Communicator

You'll want to do |sort +_time as that will sort with the earliest time first. Just ran your search in my environment to confirm. Very handy search.

dang
Path Finder

That did it. Thanks antlefebvre

0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...