sort 运算符sort operator

按照一个或多个列的顺序对输入表的行排序。Sort the rows of the input table into order by one or more columns.

T | sort by strlen(country) asc, price desc




T | sort by expression [asc | desc] [nulls first | nulls last] [, ...]T | sort by expression [asc | desc] [nulls first | nulls last] [, ...]


  • T :要排序的表输入。T : The table input to sort.
  • expression:要作为排序依据的标量表达式。expression : A scalar expression by which to sort. 值的类型必须是数字、日期、时间或字符串。The type of the values must be numeric, date, time or string.
  • asc 按升序(即由低到高)排列。asc Sort by into ascending order, low to high. 默认值是 desc,降序,由高到低。The default is desc, descending high to low.
  • nulls firstasc 顺序的默认值)将把 null 值放在开头,nulls lastdesc 顺序的默认值)将把 null 值放在末尾。nulls first (the default for asc order) will place the null values at the beginning and nulls last (the default for desc order) will place the null values at the end.


| where ActivityId == "479671d99b7b"
| sort by Timestamp asc nulls first

表 Traces 中具有特定 ActivityId 的所有行,按时间戳排序。All rows in table Traces that have a specific ActivityId, sorted by their timestamp. 如果 Timestamp 列包含 null 值,则这些值将显示在结果的前几行。If Timestamp column contains null values, those will appear at the first lines of the result.

为了从结果中排除 null 值,请在调用排序运算符之前添加筛选器:In order to exclude null values from the result add a filter before the call to sort:

| where ActivityId == "479671d99b7b" and isnotnull(Timestamp)
| sort by Timestamp asc