"sort _time" is losing days/events for timechart

[HeinzWaescher]

Hi,

i would like to sort the events by _time and create a timechart.

1. | timechart span=1d dc(user)
   Here the displayed timechart is from 2012-06-02 to 2013-10-08

2. | sort _time | timechart span=1d dc(user)
   Here the displayed timechart is from 2012-06-02 to 2013-08-02. So Splunk is losing events during the sorting process.

edit: I just checked a simple stat with, and without "sort _time" command. The result of this test was a very big difference of the count.

Thanks for help 🙂

Best

Heinz

[cramasta · Accepted solution]

The sort command by default will limit you to 10000 results. To sort and return all results you need to run the command like this

| sort 0 _time

You can read more about it here
http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Sort

[HeinzWaescher]

Hi cramasta,

thanks a lot. This was the reason, all events are sortet now 🙂
Do you know if there is a difference between | sort _time and |reverse? The result seems to be the same?

[Ayn]

Not sure why you would want to sort by _time ascending - Splunk is already returning its results in reverse chronological time (so equivalent to sort - _time) and this is what timechart wants. Just leave out your sort command and you should be fine.

[HeinzWaescher]

Hi Ayn,

thanks for your post. What i wanted to achieve is, to sort the splunk events ascending. Because i'm using a last() command in my final search, which should always write the previous fieldvalue per user in each event.

I justrecognized the missing events, because because of the shorter timechart. That's why i mentioned it first. So it was a bad explanation from my side.