Splunk Search

"Sort 0 desc" vs "sort 0 -" for data over 10,000

LearningGuy
Builder

Hello,

I don't know how to simulate this using makeresults, but I have data over 10,000 (let say 50,000)
If I sort descending using "| sort - 0 Score", it will only give me 10,000 rows, but I used "| sort 0 Score desc", it will give me 50,000 rows.
What is the different between using sort - and sort desc?   
Why doesn't sort - only limit to 10,000?   Thank you so much 

index=test
| sort - 0 Score ==>   only 10,000  rows          I need to use "| sort Score desc"  

NameScore
Name15
Name20
Name37
Name40
…. 
Name500009
Labels (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

See sort.  | sort 0 Score desc is semantically identical to | sort limit=0 Score desc. But | sort - 0 Score is equivalent to | sort 0, Score desc.  That is, you are sorting two fields, 0 and Score, in descending order and without using limit.

Sort is memory hungry.  Setting 10,000 by default is a sensible choice.

View solution in original post

yuanliu
SplunkTrust
SplunkTrust

See sort.  | sort 0 Score desc is semantically identical to | sort limit=0 Score desc. But | sort - 0 Score is equivalent to | sort 0, Score desc.  That is, you are sorting two fields, 0 and Score, in descending order and without using limit.

Sort is memory hungry.  Setting 10,000 by default is a sensible choice.

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...