Tabular Operators

order operator

Sort the rows of the input dataset into order by one or more fields.

Syntax

| order by Field [asc], Field2 [desc]

Arguments

nametypedescription
FieldstringField of dataset by which to sort. The type of the values must be numeric, date, time or string.
ascexpressoinSort by into ascending order, low to high
descexpressiondescending high to low

Example

['http-logs']
| order by ['geo.country'] asc, method desc