Sort - Reference Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR XQL Language Reference

Product
Cortex XDR
Creation date
2024-07-16
Last date published
2024-11-25
Category
Reference Guide
Retire_Doc
Retiring
Link_to_new_Doc
/r/Cortex-XDR/Cortex-XDR-Documentation/Cortex-XDR-XQL
Abstract

Learn more about the Cortex Query Language sort stage that identifies the sort order for records returned in the result set.

Syntax

sort asc|desc <field1>[, asc|desc <field2>...]

Description

The sort stage identifies the sort order for records returned in the result set. Records can be returned in ascending (asc) or descending (desc) order. If you include more than one field in the sort stage, records are sorted in field specification order.

Keep the following points in mind before running a query with the sort stage:

  • To acheive the correct sorting results when a query includes strings representing numbers, it's recommend to sort by integer fields and to convert all string fields to integers; for example, by using the to_integer function.

  • When sorting by multiple columns, the sort is saved correctly, but the user interface will only display the results according to the first sorted column.

Examples

Return the action_boot_time and event_timestamp fields from all xdr_data records. Sort the result set first by the action_boot_time field value in descending order, then by event_timestamp field in ascending order.

dataset = xdr_data 
| fields action_boot_time as abt, event_timestamp as et 
| sort desc abt, asc et
| limit 1