issue with sort command

[krish318]

Hi,

index="testdb" sourcetype="audt" | table Command, Duration | sort Duration | search Duration>=60. This search command is not working until i put the desc near "sort Duration"

So i have changed it with following command. then it is working fine
index="testdb" sourcetype="audt" | table Command, Duration | search Duration>=60| sort Duration

The objective here is to get the results for execution time taken (Duration) for the SQL commands (command) to execute.

My question is why the "sort Duration" is not working while "sort Duration desc" is working when i place it in the same location that is in the middle of the search command. is this some kind of glitch in the APP? Kindly help me on this.

[amiftah]

Can you add | convert num(Duration) before | sort Duration and see if it solves the problem?

[niketn]

@krish318 what does the data in Duration field look like? Do they always follow specific format like HH:MM:SS etc?

Would it be possible that sort is working on Alphabetic order rather than numeric based on data in the Duration field?

One of the possibilities would be to convert Duration to seconds to ensure that they sort in numerical order. We would be able to assist further only if you can share the current data Sample for the rows which are not sorting as expected.

[krish318]

Hi loglogananthan,

I tried the query you provided, but it is not working either unless i put desc near "sort" command

[logloganathan]

Could you please try this query

index="testdb" sourcetype="audt" | sort Duration | table Command, Duration | search Duration>=60

because we have to sort and then table it

[krish318]

if i type below
index="testdb" sourcetype="audt" | sort Duration desc|table Command, Duration | search Duration>=60

i am getting results with values in descending order and that is fine. But i am trying to get the same results in accessing order now with the following command which is not working. (no resulsts)

index="testdb" sourcetype="audt" | sort Duration |table Command, Duration | search Duration>=60

[krish318]

Hi logloganathan,

Thank you for your feedback.
I tried your search query but this is not working either unless i put desc near "sort" command. please advice

[krish318]

if i type below
index="testdb" sourcetype="audt" | sort Duration desc|table Command, Duration | search Duration>=60

i am getting results with values in descending order and that is fine. But i am trying to get the same results in accessing order now with the following command which is not working. (no resulsts)

index="testdb" sourcetype="audt" | sort Duration |table Command, Duration | search Duration>=60