If the order or type parameter is a single value, all fields are sorted with the same order or type.

Setting the type field tells sort() how to compare the individual values, either using lexicographical order (for example, string), numerical magnitude (for example, number, hex). The hex argument supports numbers as strings starting with either 0x, 0X, or no prefix.

As an example, suppose you have LogScale ingesting data from a web server and want to get a list of referring domains and sub-domains. That is to say, the URLs without the path and web page from which it came (for example, just www.example.com from http://www.example.com/sales/great-sites.html). Suppose further that you want a count of each referrer and want to sort them alphabetically in reverse order — because we're fickle like that. Below is an example of how that might be done:

regex(regex="/.*/(?<ref_url>.+?)(/
| $)", field=referrer)
| groupBy(ref_url)
| sort(ref_url, type=string, order=desc, limit=12)

In the first line here, we're using the regex() function to extract just the first part of the URL, dropping everything after the domain and first slash. On the second line we're using groupBy() to group on each referrer (for example, ref_url) and counting them. If we hadn't stripped out the base URL from the first line, we might have multiple entries for each domain. See the regex() and groupBy() reference pages for more information on those query functions.

In the third line of the query above, notice the parameters for the sort() function. First is the new field ref_url we created in the first line, then type parameter to specify the values sorted may include characters or numbers. The second is how to order the results: in this case, in descending order. Last is the limit parameter to limit the results to the first twelve in the sorted list of results. The table below shows the results.

To sort events by ascending or descending value, use the order parameter, for example:

groupBy(ref_url)
| sort(ref_url, type=string, order=asc, limit=12)

The output has been ordered using a string based (for example, alphabetical) sorting method.

The limit parameter to sort() limits the number of rows returned by the function after the sort has been completed. For example, to sort metrics by the repository name and then output the top entry:

name=datasource-count
|groupBy([repo])
|sort(field=_count,type=number,order=desc,limit=1)

The above query works by sorting the grouped counts (in the _count field), explicitly setting the type to number and then sorting by high to lowest (descending order).

To sort events by ascending or descending value, use the order parameter, for example:

groupBy(ref_url)
| sort(ref_url, type=string, order=desc, limit=12)

When using multiple fields, supply a corresponding array to order parameter as the field parameter, for example:

groupBy([ref_url,method])
| sort([ref_url,method], type=string, order=[desc,asc], limit=12)

Click + next to an example below to get the full details.

#type=humio #kind=logs class=c.h.j.RunningQueriesLoggerJob message="Highest Cost query"
 | groupBy(repo, initiatingUser, totalLiveCost, totalStaticCost)
 | sort([totalLiveCost, totalStaticCost])

method=GET
groupBy(field=[method, statuscode], function=count(as=method_total))
sort([method, statuscode], order=asc)
FieldName!=""

groupby([type,kind], limit=max, function=count())
| sort(_count, order=asc)