This page explains how to use the order operator in APL.
order
operator in Axiom Processing Language (APL) allows you to sort the rows of a result set by one or more specified fields. You can use this operator to organize data for easier interpretation, prioritize specific values, or prepare data for subsequent analysis steps. The order
operator is particularly useful when working with logs, telemetry data, or any dataset where ranking or sorting by values (such as time, status, or user ID) is necessary.
Splunk SPL users
order
is sort
. SPL uses a similar syntax to APL but with some differences. In SPL, sort
allows both ascending (asc
) and descending (desc
) sorting, while in APL, you achieve sorting using the asc()
and desc()
functions for fields.ANSI SQL users
order
is ORDER BY
. SQL uses ASC
for ascending and DESC
for descending order. In APL, sorting works similarly, with the asc()
and desc()
functions added around field names to specify the order.FieldName
: The name of the field by which to sort.asc
: Sorts the field in ascending order.desc
: Sorts the field in descending order.order
operator returns the input dataset, sorted according to the specified fields and order (ascending or descending). If multiple fields are specified, sorting is done based on the first field, then by the second if values in the first field are equal, and so on.
_time | req_duration_ms | id | status | uri | method | geo.city | geo.country |
---|---|---|---|---|---|---|---|
2024-10-17 10:10:01 | 1500 | user12 | 200 | /api/v1/get-orders | GET | Seattle | US |
2024-10-17 10:09:47 | 1350 | user23 | 404 | /api/v1/get-products | GET | New York | US |
2024-10-17 10:08:21 | 1200 | user45 | 500 | /api/v1/post-order | POST | London | UK |
top
operator returns the top N records based on a specific sorting criteria, which is similar to order
but only retrieves a fixed number of results.summarize
operator groups data and often works in combination with order
to rank summarized values.extend
operator can be used to create calculated fields, which can then be used as sorting criteria in the order
operator.