sort command examples
The following are examples for using the SPL2
To learn more about the
sort command, see How the sort command works.
1. Specify different sort orders for each field
This example sorts the results first by the
lastname field in ascending order and then by the
firstname field in descending order. Because ascending is the default sort order, you don't need to specify it unless you want to be explicit.
... | sort lastname, -firstname
2. Specify the number of sorted results to return
This example sorts the results and returns a maximum of 100 of the sorted results. The results are sorted first by the
size field in descending order. If there are duplicate values in the
size field, the results are sorted by the
source field in ascending order.
... | sort 100 -size, +source
3. Use the sort options to specify field types
Sort the results by the
ipaddress field in ascending order and then sort by the
url field in descending order.
... | sort num(ipaddress), -str(url)
sort command usage
spl1 command overview
This documentation applies to the following versions of Splunk® Cloud Services: current