sort
Sorts input data based on the specified fields.
Syntax
sort [limit=INT] [-]FIELD, ... [by PARTITION_FIELD, ...]
Required Parameter
[-]FIELD, ...
- Sort fields and order in which to sort the input data set, separated by a comma (
,
). The default order of the field is ascending order. To sort in descending order, prefix the name with a minus symbol(–
).
Optional Parameter
limit=INT
- Number of records to return from the sorted results (default: unlimited).
by PRTITION_FIELD, ...
- After partitioning based on the value of the partition field, you can sort records by partition. If you use the
limit
option with theby
clause, the command returns top n records from each partition.
Usage
-
Return the top 10 records in descending order based on the count field.
sort limit=10 -count
-
Return the top 10 records in descending order based on the bytes and pkts fields.
sort limt=10 -bytes, -pkts
-
Return the top 10 records in descending order based on the bytes and pkts fields for each src and dst.
sort limt=10 -bytes, -pkts by src, dst