Hi,
i would like to sort the events by _time and create a timechart.
| timechart span=1d dc(user)
Here the displayed timechart is from 2012-06-02 to 2013-10-08
| sort _time | timechart span=1d dc(user)
Here the displayed timechart is from 2012-06-02 to 2013-08-02. So Splunk is losing events during the sorting process.
edit: I just checked a simple stat with, and without "sort _time" command. The result of this test was a very big difference of the count.
Thanks for help 🙂
Best
Heinz
The sort command by default will limit you to 10000 results. To sort and return all results you need to run the command like this
| sort 0 _time
You can read more about it here
http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Sort
The sort command by default will limit you to 10000 results. To sort and return all results you need to run the command like this
| sort 0 _time
You can read more about it here
http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Sort
Hi cramasta,
thanks a lot. This was the reason, all events are sortet now 🙂
Do you know if there is a difference between | sort _time and |reverse? The result seems to be the same?
Not sure why you would want to sort by _time
ascending - Splunk is already returning its results in reverse chronological time (so equivalent to sort - _time
) and this is what timechart
wants. Just leave out your sort command and you should be fine.
Hi Ayn,
thanks for your post. What i wanted to achieve is, to sort the splunk events ascending. Because i'm using a last() command in my final search, which should always write the previous fieldvalue per user in each event.
I justrecognized the missing events, because because of the shorter timechart. That's why i mentioned it first. So it was a bad explanation from my side.