Splunk Search

changing the sort order of _time from a streamstats output

dang
Path Finder

I'm attempting to figure out the average reboot times of a server with the following search:

index=main host=MYSERVER source=WinEventLog:System (EventCode="6006" OR EventCode="6005")  | transaction host startswith=6006 endswith=6005 maxevents=2  | table host duration _time| streamstats avg(duration) as stream | eval average=round(stream,2) | fields - stream | convert timeformat=%M:%S ctime(duration)  | convert timeformat=%M:%S ctime(average)

Everything works as expected, except I can't seem to properly reverse the sort order of the dates (technically the _time field). No matter where I add a clause of | sort - _time) | I can't seem to get the data to sort the way I want, which is to have the earliest date at the top, and the latest (most current) date at the bottom of the list. Even evaling _time to another name did not seem to help. I'm unsure what I'm doing wrong here.

I'm using version 5.0.3, build 163460, if that helps. Any suggestions?

1 Solution

antlefebvre
Communicator

You'll want to do |sort +_time as that will sort with the earliest time first. Just ran your search in my environment to confirm. Very handy search.

View solution in original post

antlefebvre
Communicator

You'll want to do |sort +_time as that will sort with the earliest time first. Just ran your search in my environment to confirm. Very handy search.

dang
Path Finder

That did it. Thanks antlefebvre

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...