By default, everything in the Gravwell search pipeline is temporally sorted. The web interface provides some additional sorting capabilities while maintaining the raw power of temporal sorting on the search backend.

The sort module, however, allows the user to sort on other values. This can be very useful for organizing information. For example, a query to display a table of the top domains requested from the dnsmasq daemon might look like:

tag=syslog grep dnsmasq | regex ".*query\[A\]\s(?P<dnsquery>[a-zA-Z0-9\.\-]+)" | count by dnsquery | sort by count desc | table dnsquery count

The syntax is sort [by sortparam] [asc/desc]. sortparam is the parameter to sort by, which can be time, tag, src, or any enumerated value. The sort parameter is optional; if not specified, it defaults to time. The other parameter selects the direction of sorting, either ascending (asc) or descending (desc). If not specified, it defaults to descending sort for time and ascending sort for all other parameters.

Some example sort invocations:




Sort by time in descending order

sort by tag

Sort by entry tag in ascending order

sort by count asc

Sort by an enumerated value called “count” in ascending order

sort asc

Sort by time in ascending order

sort by src desc

Sort by entry source in descending order


The sort module collapses the pipeline and can restrict second order temporal searching for all renderers. This means that the overview graph and timeslice selection in the web interface will not affect a search that has been sorted non-temporally. Care must be taken to ensure that any pipeline modules following sort are expecting non-temporally ordered data.