VMware ESXi and vSphere Cluster Management

Splunk sort Command: Sort Search Results by Field

Learn how to use the Splunk sort command to order raw events and statistical results by one or more fields in ascending or descending order.

What the Splunk sort Command Does

The sort command is an SPL command that orders search results using one or more fields. It changes the sequence in which results are displayed; it does not filter results out because of their field values.

Sorting is useful when you need to review events in a predictable order, rank calculated values, compare categories, or find the largest and smallest measurements. For example, you can place the events with the longest response times first or arrange product categories alphabetically.

Prerequisites: You should know how to run a basic Splunk search, chain commands with the pipe character, and recognize fields such as host, categoryId, and _time.

Basic sort Syntax

Place sort after the search or command that produces the results you want to order:

search | sort [limit] [direction]field [direction]field ...

A field is a named value extracted from an event or created by another command. Each field used by sort is a sort key: Splunk uses its values to determine row order.

Element — Meaning — Example

sort command name — Orders the results — | sort

Optional numeric limit — Sets the maximum number of sorted results — | sort 25

Plus prefix — Requests ascending order — +categoryId

Minus prefix — Requests descending order — -response_time

First and later field names — Define primary and secondary sort keys — +categoryId -_time

Ascending Order

Ascending order goes from lower to higher values. For text, this commonly means alphabetic order from A to Z. Ascending order is the default when no direction prefix is supplied.

index=shop | sort categoryId

With values such as ACCESSORIES, SHOES, and TEE, the results are arranged alphabetically. You can make the direction explicit by adding a plus sign directly before the field:

index=shop | sort +categoryId

sort categoryId and sort +categoryId request the same ascending direction.

Descending Order

Descending order goes from higher to lower values. For text, this commonly means reverse alphabetic order from Z to A. Add a minus sign directly before the field name:

index=shop | sort -categoryId

This places categories such as TEE before ACCESSORIES, reversing the default order.

Descending order is especially useful for numeric rankings. This example places the events with the greatest response times first and returns up to 20 ordered results:

index=web | sort 20 -response_time

The numeric value 20 is the result limit, and -response_time means highest response time first.

Search fragment — Direction — Expected ordering

sort categoryId — Default ascending — Categories from alphabetically low to high

sort +categoryId — Explicit ascending — Categories from alphabetically low to high

sort -categoryId — Descending — Categories from alphabetically high to low

sort 10 -count — Descending with a limit — Ten rows with the largest counts first

Sorting by Multiple Fields

You can provide several sort keys. Splunk evaluates them from left to right:

index=shop | sort +categoryId -_time

The first field, categoryId, is the primary sort field. It determines the main grouping and order. The second field, _time, is a tie breaker: it is considered only when two or more results have the same categoryId. The minus sign places the newest timestamp first within each category.

Directions apply independently to each field. For example, +categoryId -response_time sorts categories in ascending order and places the largest response time first among results in the same category.

The sort Result Limit

The optional numeric limit appears immediately after sort and before the direction and field names. It controls how many ordered results are returned. When no explicit limit is supplied, sort normally uses its standard limit of 10,000 results.

index=web | sort 25 -response_time

This command orders results by descending response time and returns up to 25 results. When your goal is to find only the top or bottom values, use a small explicit limit rather than sorting an unnecessarily large result set.

sort 0 requests sorting without the command's result limit:

index=shop earliest=-15m | sort 0 categoryId

Use this only with an appropriately bounded search. Removing the limit can require Splunk to hold and order a large number of results, which may consume substantial resources.

Field Values and Data Types

Splunk orders field values alphabetically or numerically according to the values and their field interpretation. Numeric fields generally sort from smaller to larger values in ascending order. Text fields sort according to their textual representation.

Numeric-looking text can produce surprising results. For example, text values such as 2, 10, and 100 may be compared as strings, producing an order like 10, 100, 2 instead of numeric order. Inconsistent formatting, units mixed into values, or missing values can cause similar problems.

Before sorting, use consistent field extraction and normalization. If a value needs calculation or conversion, create a reliable field before sort, commonly with eval. Verify sample values in the results and ensure that the field is consistently represented as the intended type.

Where to Place sort in a Search Pipeline

Place sort after the command that creates, extracts, aggregates, or filters the field you want to order. For raw events, sorting usually follows the base search and any field extraction or filtering:

index=web status=500 | sort 20 -response_time

For summarized results, aggregate first and sort the generated field afterward:

index=main | stats count by host | sort -count

Here, stats creates one row per host and produces the calculated count field. The later sort -count ranks those summary rows from the busiest host to the least busy host.

Sorting before a transforming command may not control the final presentation. A later command such as stats creates a new result set, so the earlier event order is not necessarily preserved in the summary. Sort after the command that produces the rows you want users to inspect.

Use table after sorting when you want to select displayed columns without changing the intended row order:

index=main | stats count by host | sort 10 -count | table host count

Performance Considerations

Sorting requires Splunk to compare results and maintain their order. Sorting a large set of raw events can consume more memory, CPU, and search time than a narrowly scoped search.

Narrow the base search with the correct index, time range, and useful filters.
Filter irrelevant rows before sorting when possible, for example with where.
Select or create only the fields needed for the final result.
Aggregate raw events with stats first when the question is about groups, counts, or other summaries.
Use a small explicit limit when you need only the largest or smallest few results.
Use sort 0 only when the search scope is controlled and a complete ordered result set is genuinely required.

If the goal is to find the most common field values, a frequency-oriented command such as top may be more suitable than sorting every raw event. If the goal is to rank calculated summary rows, use stats followed by sort.

Need — Recommended approach — Reason

Order raw events by a field — Use sort after the base search — Directly orders the event rows.

Rank aggregated statistics — Use stats, then sort — Sorts a smaller summary result set.

Return only the largest few values — Use a small limit such as sort 10 -field — Avoids returning unnecessary rows.

Avoid expensive full-result sorting — Narrow the search or use an appropriate aggregation such as top — Reduces the amount of data that must be ordered.

Troubleshooting sort Searches

Results Are in the Opposite Direction

If results are ordered opposite to your expectation, the field may have no direction prefix or may use + when you intended descending order. Add a minus sign directly before the field:

| sort -categoryId

The Largest Count Is Not First

Default sorting is ascending, so a calculated count may show the smallest values first. Rank the field in descending order:

| stats count by host | sort -count

The Field Cannot Be Sorted

The field may not have been extracted, may have been renamed, or may have been removed by an earlier command. Confirm that it appears in the current results, create or rename it before sort, and place sort after the command that generates it.

Numeric Values Have an Unexpected Sequence

Check whether the values are consistent numeric data or text representations. Inspect sample values, remove inconsistent formatting, and normalize or convert the field before sorting.

Only Some Ordered Results Appear

A numeric limit may be restricting the output. Review the command, increase the limit if needed, or use sort 0 only after reducing the search scope.

The Search Became Slow

Too many raw events may be getting ordered. Reduce the time range, narrow the base search, aggregate before sorting, and request only the number of rows you need.

The Secondary Sort Does Not Change Anything

Later fields are tie breakers, not independent global orderings. They apply only where earlier field values match. Test with repeated values in the primary field to verify the secondary rule.

Quick Reference

| sort field_name
| sort +field_name
| sort -field_name
| sort 25 -field_name
| sort +field_one -field_two
| stats count by host | sort -count
| sort 0 field_name

For related learning, review the Splunk sort command guide alongside searches that use stats, where, top, eval, and table.