Scenario

You have a log file /tmp/app_combined.log with entries from multiple servers in mixed order. Each line contains: timestamp, hostname, and action.

Task

Sort /tmp/app_combined.log by timestamp (earliest first), then by hostname for identical timestamps. Save the output to /tmp/app_sorted.log.

Example

# Before (mixed order)
2025-12-18 14:23:45 api02 POST /users/create
2025-12-18 14:22:10 cache01 CACHE_MISS key=session_abc
2025-12-18 14:22:55 api01 GET /products/list
2025-12-18 14:22:10 db02 INSERT INTO orders VALUES
2025-12-18 14:24:12 cache01 CACHE_SET key=user_profile

# After (sorted by timestamp, then hostname)
2025-12-18 14:22:10 cache01 CACHE_MISS key=session_abc
2025-12-18 14:22:10 db02 INSERT INTO orders VALUES
2025-12-18 14:22:55 api01 GET /products/list
2025-12-18 14:23:45 api02 POST /users/create
2025-12-18 14:24:12 cache01 CACHE_SET key=user_profile

Step 1: View the current unsorted log file

cat /tmp/app_combined.log

Step 2: Sort the log file by date, time, and hostname

sort -k1,1 -k2,2 -k3,3 /tmp/app_combined.log > /tmp/app_sorted.log

The -k1,1 sorts by column 1 (date), -k2,2 by column 2 (time), and -k3,3 by column 3 (hostname). Multiple -k options define sort priority from left to right. The > redirects output to a new file, preserving the original.