Sort data

About data sorting

You can modify the default sorting in a data table, replacing it with a sorting based on the values in a specific field. Note that table fields don’t sort independently from each other—all the cells in a row stay together when you sort a field.

Incomplete sorting

When sorting field data, you must turn on at least the Load all only when sorting to consider all the events in the selected time range. Otherwise, only the events currently downloaded will be sorted, and a warning will prompt you to activate the option.

You can find this option in the event loading indicator at the left corner of the search window. Learn more about the available event loading preferences here.

Open

Sorting data using values from one field

To sort data using the values in a field simply click the arrows icon in the field header.

• Click once to apply an ascending sorting (from A to Z, or smallest number to largest). The icon changes to show only the down arrow lit up.

• Click a second time to apply a descending sorting (from Z to A, or largest number to smallest). The icon changes to show only the up arrow lit up.

• Click a third time to reestablish the default chronological sorting. The icon goes back to its original state with both arrows lit up.

Open

Sorting data using values from multiple fields

You can stack the sorting of several fields to create a compound sorting. Simply apply ascending or descending sorting as explained above to as many fields as desired. However, there is an important consideration:

The priority for sorting is from left to right. This means that data is sorted using the values of the left-most field first, and subsequent sorting cannot alter this unless there are repeated values. In such cases, the next sorting can only further sort within the blocks of these repeated values (see picture below).