order

This page explains how to use the order operator in APL.

The order operator in Axiom Processing Language (APL) allows you to sort the rows of a result set by one or more specified fields. You can use this operator to organize data for easier interpretation, prioritize specific values, or prepare data for subsequent analysis steps. The order operator is particularly useful when working with logs, telemetry data, or any dataset where ranking or sorting by values (such as time, status, or user ID) is necessary.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

Splunk SPL users

In Splunk SPL, the equivalent operator to order is sort. SPL uses a similar syntax to APL but with some differences. In SPL, sort allows both ascending (asc) and descending (desc) sorting, while in APL, you achieve sorting using the asc() and desc() functions for fields.

ANSI SQL users

In ANSI SQL, the equivalent of order is ORDER BY. SQL uses ASC for ascending and DESC for descending order. In APL, sorting works similarly, with the asc() and desc() functions added around field names to specify the order.

Usage

Syntax

| order by FieldName [asc | desc], FieldName [asc | desc]

Parameters

• FieldName: The name of the field by which to sort.
• asc: Sorts the field in ascending order.
• desc: Sorts the field in descending order.

Returns

The order operator returns the input dataset, sorted according to the specified fields and order (ascending or descending). If multiple fields are specified, sorting is done based on the first field, then by the second if values in the first field are equal, and so on.

Use case examples

• Log analysis
• OpenTelemetry traces
• Security logs

In this example, you sort HTTP logs by request duration in descending order to prioritize the longest requests.

Query

['sample-http-logs']
| order by req_duration_ms desc

Run in Playground

Output

_time	req_duration_ms	id	status	uri	method	geo.city	geo.country
2024-10-17 10:10:01	1500	user12	200	/api/v1/get-orders	GET	Seattle	US
2024-10-17 10:09:47	1350	user23	404	/api/v1/get-products	GET	New York	US
2024-10-17 10:08:21	1200	user45	500	/api/v1/post-order	POST	London	UK

This query sorts the logs by request duration, helping you identify which requests are taking the most time to complete.

List of related operators

• top: The top operator returns the top N records based on a specific sorting criteria, which is similar to order but only retrieves a fixed number of results.
• summarize: The summarize operator groups data and often works in combination with order to rank summarized values.
• extend: The extend operator can be used to create calculated fields, which can then be used as sorting criteria in the order operator.