This page explains how to use the sort operator function in APL.
sort
operator in APL arranges the rows of a result set based on one or more fields in ascending or descending order. You can use it to organize your data logically or optimize subsequent operations that depend on ordered data. This operator is useful when analyzing logs, traces, or any dataset where the order of results matters, such as when you’re interested in top or bottom performers, chronological sequences, or sorting by status codes.
Splunk SPL users
sort
is the sort
command, which orders search results based on one or more fields. However, in APL, you must explicitly specify the sorting direction for each field, and sorting by multiple fields requires chaining them with commas.ANSI SQL users
ORDER BY
clause. The APL sort
operator behaves similarly but uses the by
keyword instead of ORDER BY
. Additionally, APL requires specifying the order direction (asc
or desc
) explicitly for each field.Field1
, Field2
, …: The fields to sort by.asc
for ascending order or desc
for descending order.project
and sort
in the same query, ensure you project the fields that you want to sort on. Similarly, when you use project-away
and sort
in the same query, ensure you don’t remove the fields that you want to sort on.
The above is also true for time fields. For example, to project the field status
and sort on the field _time
, project both fields similarly to the query below:
_time | req_duration_ms | id | status | uri | method | geo.city | geo.country |
---|---|---|---|---|---|---|---|
2024-10-18 12:34:56 | 5000 | abc1 | 500 | /api/data | GET | New York | US |
2024-10-18 12:35:56 | 4500 | abc2 | 200 | /api/users | POST | London | UK |
top
to return a specified number of rows with the highest or lowest values, but unlike sort
, top
limits the result set.project
to select and reorder fields without changing the order of rows.extend
to create calculated fields that can then be used in conjunction with sort
to refine your results.summarize
to group and aggregate data before applying sort
for detailed analysis.