Splunk Search

How to reverse the order of displayed events?

the_wolverine
Champion

Got this question today from someone who needs to reverse the order of the search results for their troubleshooting purposes.

Tags (1)

the_wolverine
Champion

By default, Splunk displays your search results from most recent to oldest. You can reverse the order by appending your search with '| reverse'. For example:

sourcetype=foo | reverse

HeinzWaescher
Motivator

Hi,

thanks for your explanation! Then the " | reverse " function will fit my needs in most of the cases.

0 Karma

sowings
Splunk Employee
Splunk Employee

Try it. You'll find that sort - _time doesn't deal with events that have the same time stamp in the same way as reverse. Reverse literally flips the event stream top to bottom, but the sort might leave "simultaneous" events in the original "new stuff on top" order. This is probably only meaningful if you have an event stream that is part of a transaction, and you're used to reading it in "log" order.

HeinzWaescher
Motivator

Hi,

what is the difference between " | reverse " and "| sort - _time " ? I would expect the same effect?

0 Karma

jrodman
Splunk Employee
Splunk Employee

Note that this reversal is not free. For smaller numbers of events, it will be totally fine. For millions of events it is some significant amount of work.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...