|
I just ran a search that returned approximately 1 million results. Only after it completed (which took a bit longer than I'd anticipated), did I realize that I wanted the results sorted differently. So when I went to reverse the results (actually added a '-' to my sort) Splunk reran the search. The events have already been found, is there anyway to reverse/reorder them in place without rerunning the whole search? |
One Answer:
|
You can click on the field you want sort by in the results - not sure if that's what you were looking for. oh, sure enough. I've never noticed that before.
(30 Sep '10, 14:24)
thepocketwade
|
