Splunk Search

"sort _time" is losing days/events for timechart

HeinzWaescher
Motivator

Hi,

i would like to sort the events by _time and create a timechart.

  1. | timechart span=1d dc(user)
    Here the displayed timechart is from 2012-06-02 to 2013-10-08

  2. | sort _time | timechart span=1d dc(user)
    Here the displayed timechart is from 2012-06-02 to 2013-08-02. So Splunk is losing events during the sorting process.

edit: I just checked a simple stat with, and without "sort _time" command. The result of this test was a very big difference of the count.

Thanks for help 🙂

Best

Heinz

Tags (3)
0 Karma
1 Solution

cramasta
Builder

The sort command by default will limit you to 10000 results. To sort and return all results you need to run the command like this

| sort 0 _time

You can read more about it here
http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Sort

View solution in original post

0 Karma

cramasta
Builder

The sort command by default will limit you to 10000 results. To sort and return all results you need to run the command like this

| sort 0 _time

You can read more about it here
http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Sort

0 Karma

HeinzWaescher
Motivator

Hi cramasta,

thanks a lot. This was the reason, all events are sortet now 🙂
Do you know if there is a difference between | sort _time and |reverse? The result seems to be the same?

0 Karma

Ayn
Legend

Not sure why you would want to sort by _time ascending - Splunk is already returning its results in reverse chronological time (so equivalent to sort - _time) and this is what timechart wants. Just leave out your sort command and you should be fine.

0 Karma

HeinzWaescher
Motivator

Hi Ayn,

thanks for your post. What i wanted to achieve is, to sort the splunk events ascending. Because i'm using a last() command in my final search, which should always write the previous fieldvalue per user in each event.

I justrecognized the missing events, because because of the shorter timechart. That's why i mentioned it first. So it was a bad explanation from my side.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...