Sort

The sort tranform is used to determine how to arrange events returned in a TQL search.

Sort syntax

mql query | sort [<order>] <field>

Note
TQL was previously called MQL. You still use and see mql in TQL queries.

`<order>`	Controls the order of the results. Must be > (descending order) or < (ascending order). When using key/value syntax, the strings “desc” or “asc” are also acceptable. This argument is optional, and, when omitted, will default to descending order.
`<field>`	The field that determines how search results are sorted. You may specify a set of fields here to sort on multiple fields.

Examples

Query	Result
`tcp \| sort < srcport`	Search and return results for `tcp` and sort them into ascending order by `srcport`.
`tcp \| sort > srcport`	Search and return results for `tcp` and sort them into descending order by `srcport`.

Sorting by multiple fields

Query	Result
`tcp \| sort < [srcport,dstport]`	Search and return results for `tcp` and sort into ascending order first by `srcport` and then by `dstport`.

Note
The sort transform can also be passed as a separate transform in a query, as shown in the following example.

Query	Result
`tcp \| sort < srcport \| sort > dstport`	First, search and return results for `tcp` and sort results in ascending order by `srcport`. Then, for all identical `srcport` values, sort by `dstport` in descending order.