order

Sorts in ascending or descending order on one or more fields.

asc or desc specifies whether the results are ordered in ascending (asc) or descending (desc) order. The default order is ascending.

Use order to sort the results in a data stream for display. You can use order with ungrouped data. You can also use order to sort grouped data by an aggregated value.

Do not use order to specify the order that another SAQL statement or function will process records in. For example, do not use order before timeseries to change the order of processing. Instead, use timeseries parameters.

By default, nulls are sorted last when sorting in ascending order and first when sorting in descending order. You can change the ordering of nulls using nulls [first | last].

Applying labels to dimension values in the XMD changes the displayed values, but doesn’t change the sort order.

q = order q by 'count' desc;

To order a stream by multiple fields, use this syntax:

You can order a cogrouped stream before a foreach statement:

By default, nulls are sorted first when sorting in descending order. To change the null sort order to last, use this syntax:

You can’t reference a preprojection ID in a postprojection order operation. (Projection is another term for a foreach operation.) This code throws an error:

This code is valid:

See Also