Splunk Search

"Sort 0 desc" vs "sort 0 -" for data over 10,000

LearningGuy
Builder

Hello,

I don't know how to simulate this using makeresults, but I have data over 10,000 (let say 50,000)
If I sort descending using "| sort - 0 Score", it will only give me 10,000 rows, but I used "| sort 0 Score desc", it will give me 50,000 rows.
What is the different between using sort - and sort desc?   
Why doesn't sort - only limit to 10,000?   Thank you so much 

index=test
| sort - 0 Score ==>   only 10,000  rows          I need to use "| sort Score desc"  

NameScore
Name15
Name20
Name37
Name40
…. 
Name500009
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

See sort.  | sort 0 Score desc is semantically identical to | sort limit=0 Score desc. But | sort - 0 Score is equivalent to | sort 0, Score desc.  That is, you are sorting two fields, 0 and Score, in descending order and without using limit.

Sort is memory hungry.  Setting 10,000 by default is a sensible choice.

View solution in original post

yuanliu
SplunkTrust
SplunkTrust

See sort.  | sort 0 Score desc is semantically identical to | sort limit=0 Score desc. But | sort - 0 Score is equivalent to | sort 0, Score desc.  That is, you are sorting two fields, 0 and Score, in descending order and without using limit.

Sort is memory hungry.  Setting 10,000 by default is a sensible choice.

Get Updates on the Splunk Community!

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Customers Increasingly Choose Splunk for Observability

For the second year in a row, Splunk was recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for ...