Splunk Search

changing the sort order of _time from a streamstats output

dang
Path Finder

I'm attempting to figure out the average reboot times of a server with the following search:

index=main host=MYSERVER source=WinEventLog:System (EventCode="6006" OR EventCode="6005")  | transaction host startswith=6006 endswith=6005 maxevents=2  | table host duration _time| streamstats avg(duration) as stream | eval average=round(stream,2) | fields - stream | convert timeformat=%M:%S ctime(duration)  | convert timeformat=%M:%S ctime(average)

Everything works as expected, except I can't seem to properly reverse the sort order of the dates (technically the _time field). No matter where I add a clause of | sort - _time) | I can't seem to get the data to sort the way I want, which is to have the earliest date at the top, and the latest (most current) date at the bottom of the list. Even evaling _time to another name did not seem to help. I'm unsure what I'm doing wrong here.

I'm using version 5.0.3, build 163460, if that helps. Any suggestions?

1 Solution

antlefebvre
Communicator

You'll want to do |sort +_time as that will sort with the earliest time first. Just ran your search in my environment to confirm. Very handy search.

View solution in original post

antlefebvre
Communicator

You'll want to do |sort +_time as that will sort with the earliest time first. Just ran your search in my environment to confirm. Very handy search.

dang
Path Finder

That did it. Thanks antlefebvre

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...