- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi, I tried to format the eventtime and would like to show the latest time event first. However, the search string below always displays the oldest event first, What's even weird is that when I clicked on the Time header in the table, the column is still not sorted. I am wondering if anyone can shed some light on this? Thank you!
| bucket _time span=60m | eval Time=strftime(_time, "%m/%d %H:%M %Z") | STATS avg(time_taken) AS AverageResponseTime BY Time | sort by Time desc
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Your syntax is a little off. Have a look at sort's syntax here: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Sort
This should work better:
... | sort - Time
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

If you are trying to sort by the extracted timestamp, then _time is what you want to use i.e.
| sort -_time
I just hit this and it was driving me nuts as I was using Time and not seeing the expected result.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Your syntax is a little off. Have a look at sort's syntax here: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Sort
This should work better:
... | sort - Time
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi there, this answer isn't working for me. Here's the query I'm typing:
name@email.com | sort - Time
And in the output I'm seeing:
Time
5/2/19 7:38:41.000 PM
5/2/19 7:38:44.769 PM
5/2/19 7:38:44.000 PM
So, not only is the order not descending, but it's not even sorted. Splunk is ignoring my sort directive altogether and is just doing whatever it wants instead.
Please advise?
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello, it doesn't seems to work for me 😞
The source type is log4j logs. Splunk (light) successfully parsed date/time and shows me separate column in search results with name "Time". I tried (with space and without space after minus):
| sort -Time
| sort -_time
Whatever I do it just ignore and sort results ascending.
I figured out that if I put wrong field name it does the same. The name "_time" I tried to use because when you click on the value in Time column it shows option to show events before or auto and tell me that the field name is "_time". Could you make any suggestion please?
