Learn more about the Cortex Query Language sort
stage that identifies the sort order for records returned in the result set.
Syntax
sort asc|desc <field1>[, asc|desc <field2>...]
Description
The sort
stage identifies the sort order for records returned in the result set. Records can be returned in ascending (asc
) or descending (desc
) order. If you include more than one field in the sort
stage, records are sorted in field specification order.
Keep the following points in mind before running a query with the sort stage:
To acheive the correct sorting results when a query includes strings representing numbers, it's recommend to sort by integer fields and to convert all string fields to integers; for example, by using the
to_integer
function.When sorting by multiple columns, the sort is saved correctly, but the user interface will only display the results according to the first sorted column.
Examples
Return the action_boot_time
and event_timestamp
fields from all xdr_data
records. Sort the result set first by the action_boot_time
field value in descending order, then by event_timestamp
field in ascending order.
dataset = xdr_data | fields action_boot_time as abt, event_timestamp as et | sort desc abt, asc et | limit 1