sort
Use the sort operator to sort the results table by the specified field, in ascending or descending order.
Caution: To correctly sort different columns, use the sort operator in your AQL query instead of using the sort icon next to the column name.
Syntax
|sort <field> [asc|desc]
|sort by <field> [asc|desc]
Usage
You can sort by one or more fields. Ascending order (low to high) or descending order (high to low). The alternative syntax shown above are equivalent.
Examples
Example 1: Sort field values in ascending order.
|sort sourcetype ascExample 2: Sort field values in descending order using alternative syntax.
|sort by num_column descExample 3: Selects key OCSF fields, drops src_endpoint.hostname, then sorts all results alphabetically by product name.
ocsf | fields event_time, metadata.product.name, src_endpoint.hostname, activity_name | fields - src_endpoint.hostname | sort metadata.product.name