Hi all, got the problem with sort, When I change the time format from default e.g. 2020-05-08 19:46:20 to this :08/05/20 19:46:20 by the use  this conversion command:  | eval _time=strftime(_time,"%d/%m/%y %H:%M:%S") the sort function does not work. To overcome this, I can put the sort command e.g.  "  | sort -_time " prior eval command but this does not resolve the main Splunk build in feature .i. e. arrows up and down next to the table headers.  Since I changed the time output format the sort will work only on one page with results, if there are multiple pages with results, this will not work, is this normal? ... View more