This one is tricky. I'm not sure if this would be allowed because I'm not sure if you can have LITERALs as field names. The [Splunk documenation](http://docs.splunk.com/Documentation/Splunk/latest/knowledge/Aboutfields) doesn't talk about any restrictions on field names, but seems to kind of implicitly assume they are just WORDs or IDs. Unless it appears in the query data set, maybe just skip it? I will pull some example sort queries soon to see if there are any that don't correspond to the test cases you already have.