An Introduction to Indexing and Searching - Splunk Essentials - page 40

The sort command

This group contains just the sort command. Here are some examples of sorts and what they
do:

Command What it Does

This command sorts in ascending order by userid (A to Z, 1 to infinity, depending on whether the
anyfield field is a number or name). The 0 means that all results are sorted, not just the default 10,000.

sort 0 any-
field

sort 1000
fieldone
-fieldtwo

Sorts by fieldone in ascending order, then by fieldtwo in descending order, and returns up to
1,000 results.

sort
-fieldone,
+fieldtwo

Sorts by fieldone in descending order, and fieldtwo in ascending order. This command will re-
turn 10,000 results (the default).