Cisco Observability Platform Query Service API

ORDER

The ORDER clause specifies the observation fields that you want to sort in the query results. It allows you to sort the results in ascending or descending order.

You can use the ORDER clause to sort the following:

  • Entities

  • Events

  • Traces and spans

Note

The metric time series (the metrics() function) are always sorted by the timestamp.

Entity Ordering

You can sort the entities by the following observations:

  • field: id
  • field: type
  • field: createdAt
  • field: updatedAt
  • field: attributes (attribute_name)
  • field: tags (tag_name)
  • scalar metrics: metrics(<type>, <source>).<consumption_function>
  • function isActive: isActive
  • aggregations: count

Event Ordering

You can sort the events by the field timestamp.

Traces and Spans Ordering

You can sort traces and spans by a single column and by all type fields:

  • string (For example, spanID for spans)

  • number (For example, numErrors for traces)

  • duration (For example, duration for traces)

  • timestamp (For example, startedAt for spans)

  • boolean (For example, hasRoot for traces)

How to specify fields to order the results

In UQL, the order directions are:

  • ascending: represented by the asc() function

  • descending: represented by the desc() function

For an event, specify how you want the results to be sorted. The query implicitly supports only the event timestamp field. Hence, the asc() or desc() direction need not explicitly state the field to sort by. For example:

block}
Copy
FETCH
   events(logs)
      {timestamp, attributes("severity"), raw, eventFields}
FROM
   entities(pod)
ORDER
   events.desc()

Alias

In the ORDER clause, you can use an alias for an observation field and sort the field by using the asc() or desc() functions. Alias reduces clutter in the query and makes the query simple and easy to read.

To sort (order) topology, you must use an alias. The order for topology accepts a chain of order instructions (multiple order functions) where each order instruction should have its order direction. For more information, see Topology Context.

Note

You must use an alias in the FETCH statement to define what to sort by.

For example:

Code Snippet
CopyFETCH 
  id,
  eCt: createdAt,
  eAttr: attributes("service.name")
FROM 
  entities(service)
ORDER
  topology.desc(eCt).asc(eAttr)

To sort spans and traces, you can also use an alias for an observational field. However, it is optional.

For example:

Code Snippet
Copy  FETCH
    spans[count != '48000' ]{ name: attributes('service.name'), count}
  ORDER spans.asc(name)

For spans and traces, you can't use multiple order functions such as ORDER spans.asc(count).desc(name). You must use a single-order function.

Next