Getting Data In

How to sort the output baed on time and host?

shahhe
Explorer

How can I order the results by time (_time + _subsecond fields) and then by host field?

Thanks.

Tags (3)
0 Karma

shahhe
Explorer

I could not figure out how to markdown text in the comments, so I am posting my script as an answer.

Here is the python script

import time
import string
import splunk 
import splunk.auth 
import splunk.search

searchQuery = r"search sourcetype=retrans daysago=1 WARNING | sort _time"
splunk.mergeHostPath('splunkserv:8089', True) 
key = splunk.auth.getSessionKey('user','passwd') 
job = splunk.search.dispatch(searchQuery) 

while not job.isDone: 
time.sleep(1) 

for x in job.events: 
   print x.fields 

job.cancel()
0 Karma

Paolo_Prigione
Builder

Try appending this to your search string:

| sort -_time +host

Which will sort in descending time order, then ascending host order

0 Karma

shahhe
Explorer

sourcetype="retrans" daysago="1" WARNING | sort _time

This query works from the web interface, but not from my python script.

0 Karma

Paolo_Prigione
Builder

Could you post your complete search string?

0 Karma

shahhe
Explorer

I also tried '| sort _time' and I get no results.

0 Karma

shahhe
Explorer

Thanks for the answer.
This query returns rows in descending order.
How do I sort in ascending order by time?
When I use +_time I get nothing.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...