thanks! That solves the issue. And "sort 0 _time" doesn't have the flaw that reverse has. ... View more

reverse is bugged. Big blocks of log lines are several hours shifted away from where they should be. I recommend to never use it. ... View more

and how do I export more than 10.000 rows if I want them sorted by timestamp? That is a necessary sort because Splunk default behaviour is to sort rows in wrong order. ... View more

I guess we're already off-topic here. I have absolutley no clue what an index is and how I can find out which fields are in the index. I guess I'll have to study the query stuff more. ... View more

thanks, I got a step further. When I use the search as you described, I can now see the kubernetes_container_name as a column, but the columns time, log and message are empty. How can I fix that?   ... View more

in an attempt to be a bit clearer about what I'm looking for. I'm looking for something like this:   | time | kubernetes_container_name | log message | | 2021-09-11 21:05:15.590 | contract-mgmt | 2021-09-11 21:05:15.590 INFO 7 --- [ main] c.e.h.base.Application : Starting Application v2.3.0 using Java 11.0.10 | | 2021-09-10 20:05:15.590 | base-data-mgmt | 2021-09-10 20:05:15.590 INFO 7 --- [ main] c.e.h.contract.Application : Starting Application v1.4.0 using Java 11.0.10 |   ... View more

sorry, I thought I had posted it. The query looks like this: "Starting Application" kubernetes_cluster="prod-cluster" and I don't understand what you are referring to as "that column" in your answer. I want the kubernetes_container_name field as a column. ... View more