nano SIEM
Search Commands

reverse

reverse

Reverse the order of events in results.

Description

The reverse command reverses the order of events, turning ascending order into descending and vice versa. This is useful for changing sort direction or viewing events in opposite chronological order.

Syntax

... | reverse

Examples

Reverse chronological order

* | sort timestamp | reverse

Reverse sorted results

* | stats count() by user | sort count | reverse

View oldest first

* | reverse

After head

* | head 100 | reverse

Usage Notes

Simple reversal: Just reverses current order, doesn't sort.

vs. sort: Use sort -field instead of sort field | reverse for better performance.

Memory: Requires loading all results before reversing.

  • sort - Order results
  • head - First N events
  • tail - Last N events
On this page

On this page