# order_by¶

## Description¶

Specify the ordering when processing data. This is used by ordered windowing functions (like lag and last) as well as ordered aggregation functions (like array_agg).

Ordering is specified by alternating fields and a literal boolean for whether the field is in ascending (false) or descending (true) order. Because of backwards compatibility, the function will default to ascending if you omit specifying a boolean value, however, doing so makes for sometimes ambiguous expressions, and is not recommended.

If you have a table with columns timestamp, hostname and username, you can get a list of all users for each host, in order of timestamp within each host, by doing:

statsby list:array_agg(username, order_by(timestamp, false)), group_by(hostname)


If instead you want a list of times and hosts a user has been on, ordered by host alphabetically and reverse chronologically, you could instead do:

statsby list:array_agg(make_object(time:timestamp, host:hostname), order_by(hostname, false, timestamp, true)), group_by(username)


ordering

## Domain¶

This is a scalar function (calculates a single output value for a single input row.)

## Usage¶

order_by( [ columnname, descending ] ... [ , columnname ] ... [ , descending ] )


Argument

Type

Required

Multiple

columnname

fieldref

Optional

Can be multiple groups

descending

bool

Optional

Can be multiple groups

columnname

fieldref

Optional

Can be multiple

descending

bool

Optional

Only one

## Aliases¶

orderby (deprecated)