sort

Sorts the rows of the dataset into an order by one or more columns.

​

Syntax

| sort by Expression [asc | desc] [, ...]

​

Arguments

​

Use sort and project together

When you use project and sort in the same query, ensure you project the fields that you want to sort on. Similarly, when you use project-away and sort in the same query, ensure you don’t remove the fields that you want to sort on.

The above is also true for time fields. For example, to project the field status and sort on the field _time, project both fields similarly to the query below:

['sample-http-logs']
| project status, _time
| sort by _time desc

​

Examples

['sample-http-logs']
| where method == 'GET'
| sort by method

Run in Playground

['sample-http-logs']
| sort by _time asc, ['geo.country'] desc 

Run in Playground

['sample-http-logs']
| sort by _time desc

Run in Playground