Hi all, got the problem with sort,
When I change the time format from default e.g. 2020-05-08 19:46:20 to this :08/05/20 19:46:20 by the use this conversion command: | eval _time=strftime(_time,"%d/%m/%y %H:%M:%S") the sort function does not work.
To overcome this, I can put the sort command e.g. " | sort -_time " prior eval command but this does not resolve the main Splunk build in feature .i. e. arrows up and down next to the table headers.
Since I changed the time output format the sort will work only on one page with results, if there are multiple pages with results, this will not work, is this normal?
You possibly don't want to change _time itself, but you can change the way it is displayed e.g. fieldformat _time=strftime(_time,"%d/%m/%y %H:%M:%S")
You possibly don't want to change _time itself, but you can change the way it is displayed e.g. fieldformat _time=strftime(_time,"%d/%m/%y %H:%M:%S")