Splunk Search

"Sort 0 desc" vs "sort 0 -" for data over 10,000

LearningGuy
Builder

Hello,

I don't know how to simulate this using makeresults, but I have data over 10,000 (let say 50,000)
If I sort descending using "| sort - 0 Score", it will only give me 10,000 rows, but I used "| sort 0 Score desc", it will give me 50,000 rows.
What is the different between using sort - and sort desc?   
Why doesn't sort - only limit to 10,000?   Thank you so much 

index=test
| sort - 0 Score ==>   only 10,000  rows          I need to use "| sort Score desc"  

NameScore
Name15
Name20
Name37
Name40
…. 
Name500009
Labels (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

See sort.  | sort 0 Score desc is semantically identical to | sort limit=0 Score desc. But | sort - 0 Score is equivalent to | sort 0, Score desc.  That is, you are sorting two fields, 0 and Score, in descending order and without using limit.

Sort is memory hungry.  Setting 10,000 by default is a sensible choice.

View solution in original post

yuanliu
SplunkTrust
SplunkTrust

See sort.  | sort 0 Score desc is semantically identical to | sort limit=0 Score desc. But | sort - 0 Score is equivalent to | sort 0, Score desc.  That is, you are sorting two fields, 0 and Score, in descending order and without using limit.

Sort is memory hungry.  Setting 10,000 by default is a sensible choice.

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...