I just ran a search that returned approximately 1 million results. Only after it completed (which took a bit longer than I'd anticipated), did I realize that I wanted the results sorted differently. So when I went to reverse the results (actually added a '-' to my sort) Splunk reran the search. The events have already been found, is there anyway to reverse/reorder them in place without rerunning the whole search?
asked 30 Sep '10, 13:43
You can click on the field you want sort by in the results - not sure if that's what you were looking for.
answered 30 Sep '10, 14:16