Hi, I wonder whether someone could help me please.
I've inherited a search with the line sort 0 detail.ref,-_time
.
From the Splunk documentation, I know that sort 1 -_time
means 'return the more recent event', but could someone explain to me please what the zero means. My thought was that the line meant 'don't return the most recent event'.
Could someone possibly confirm for me please whether this assumption is correct.
Many thanks and kind regards
Chris
sort 0 means no limit and returns all result
Please read the docs
http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Sort
If you want the oldest result, you may try
sort 1 _time
without the minus sign, it will sort in ascending order
sort 0 means no limit and returns all result
Please read the docs
http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Sort
If you want the oldest result, you may try
sort 1 _time
without the minus sign, it will sort in ascending order
@chanmi2 Thank you very much for taking the time to reply to my post and for the guidance.
Kind Regards
Chris