sort

Table of Contents

This command is experimental

Definition

sort sorts defines how the results are sorted out.

Available sorting options are:

You can sort the dataset by using sort with the name of table column you want to sort.

%dpl
index=example | sort _raw

The default sorting order is ascending. You can use desc to change the sorting order to descending.

%dpl
index=example | sort _raw desc

You can also use + or - with table column names to define the sorting order.

Use + for ascending order.

%dpl
index=example | sort + _raw desc

Use - for descending order.

%dpl
index=example | sort - _raw desc

auto sorting option automatically sorts the results.

%dpl
index=example | sort auto(_raw)

ip sorting option interprets selected values as IP addresses.

%dpl
index=crud_small
| spath
| sort ip(ipaddress)

num sorting option interprets selected values as numbers.

%dpl
index=example | sort num(_raw)

str sorting option interprets selected values as strings and orders them alphabetically.

%dpl
index=crud_small
| spath
| sort str(operation)

You can limit the amount of results by adding limit or a plain integer before the table column’s name.

If the count isn’t specified or the value is 0, sort will show 5 000 results by default.

%dpl
index=example | sort 7 _raw

%dpl
index=example | sort limit=7 _raw