Splunk® Cloud Services

SPL2 Search Reference

sort command syntax details


The required syntax is in bold.


Required arguments

Syntax: <field> [,<field>]...
Description: One or more fields to sort by. When specifying more than one field, separate the field names with commas.

Optional arguments

Syntax: <integer>
Description: Specify the maximum number of results to return from the sorted results. You must specify the count before specifying the fields. If no count is specified, the default limit of 10000 is used. If 0 is specified, all of the results are returned.
Default: 10000

Using sort 0 might have a negative impact performance, depending on how many results are returned. Try to filter the results to minimize the number of results before using the sort command.

Syntax: + | -
Description: Use a minus sign ( - ) for descending order and a plus sign ( + ) for ascending order.
Default: Ascending ( + )
Syntax: auto | ip | num | str
Description: Options you can specify with <field>. The default sort option is auto. See sort command examples.
sort option Description
auto Determine the type of field value automatically. This is the default sort option.
ip Interpret the values of the field as IP addresses.
num Interpret the values of the field as numbers.
str Interpret the values of the field as strings and order the values alphabetically.

See also

sort command
sort command overview
sort command usage
sort command examples
Last modified on 18 June, 2021
sort command overview   sort command usage

This documentation applies to the following versions of Splunk® Cloud Services: current

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters