sort command

You can use the sort command to sort the search results by the specified fields in either ascending or descending order. For example, to sort the results of our search by the categoryId field, we would use the following command:

sort command example

Notice how the results were sorted in alphabetical order, with the events with the categoryId of ACCESSORIES coming first.

To sort in descending order, use a minus sign (-) before the field name:

sort command desc example

Notice that now the events containing the categoryId of TEE are displayed first.

Splunk tutorial

Splunk tutorial

Geek University 2022