Skip to main content

sort Search Operator

The sort operator orders aggregated search results. The default sort order is descending. Then you can use the top or limit operators to reduce the number of sorted results returned.

Order is also synonymous with sort. You can use them interchangeably in your queries.

Syntax

sort by <field> (displays results as descending, by default)
sort by +<field> (displays results as ascending)
sort by <field> asc (displays results as ascending)
sort by <fieldA>, <fieldB>
top <#> <field>​​​​​​​ by <group_by_operator>

Rules

  • Default sort order is descending.
  • Sorting is case sensitive with lower-case followed by upper-case.
  • To reverse the sort order to ascending, type a plus sign (+) before the field name you are sorting by. Alternatively, you can type asc after the field name.
  • To numerically sort, first cast the field to a number. Otherwise, the sort will be ordered as a text field.

Examples

status AND down | extract "user=(?<user>.*?):" | count (*) group by user | sort by _count
... | count user | top 2 user by _count
... | count user | sort by _count asc

Top 10 pages by page hits

This example counts page hits by sourceHost, sorts them by page hits, and limits the results to the top 10.

_sourceCategory=Labs/Apache/Access
| count as page_hits by _sourceHost
| sort by page_hits
| limit 10

which provides results like:

sort

For more information, see Top operator or Limit operator.

Status
Legal
Privacy Statement
Terms of Use

Copyright © 2024 by Sumo Logic, Inc.