changing the sort order of _time from a streamstats output

[dang]

I'm attempting to figure out the average reboot times of a server with the following search:

index=main host=MYSERVER source=WinEventLog:System (EventCode="6006" OR EventCode="6005")  | transaction host startswith=6006 endswith=6005 maxevents=2  | table host duration _time| streamstats avg(duration) as stream | eval average=round(stream,2) | fields - stream | convert timeformat=%M:%S ctime(duration)  | convert timeformat=%M:%S ctime(average)

Everything works as expected, except I can't seem to properly reverse the sort order of the dates (technically the _time field). No matter where I add a clause of | sort - _time) | I can't seem to get the data to sort the way I want, which is to have the earliest date at the top, and the latest (most current) date at the bottom of the list. Even evaling _time to another name did not seem to help. I'm unsure what I'm doing wrong here.

I'm using version 5.0.3, build 163460, if that helps. Any suggestions?

[antlefebvre · Accepted solution]

You'll want to do |sort +_time as that will sort with the earliest time first. Just ran your search in my environment to confirm. Very handy search.

[dang]

That did it. Thanks antlefebvre