Splunk Search

show table results in descending count order

bcusick
Communicator

Hi,

I'm thinking this has a simple solution..Is there anyway to show a table in descending order by count? Currently it always goes alphabetically.

Now:

Anthony        6
Brian          8
Michael        4

I would like to see:

Brian          8
Anthony        6
Michael        4

The way I'm currently outputting this is ` | stats count by login_name, year_day | stats count AS "Number of days Logged in" by login_name

Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Maybe ' ... | sort - "Number of days Logged in"' ?

---
If this reply helps you, Karma would be appreciated.

View solution in original post

vasanthmss
Motivator

use the below one,

| sort 0 - "Number of days Logged in"

while using sort you can mention the limitation, zero means there will not be any limits applied. 😉

V

richgalloway
SplunkTrust
SplunkTrust

Maybe ' ... | sort - "Number of days Logged in"' ?

---
If this reply helps you, Karma would be appreciated.

w531t4
Path Finder

I downvoted this post because does not work on datasets larger than 10000 rows

0 Karma

helge
Builder

Add limit=0 to remove the limitation to 10,000 rows

0 Karma

bcusick
Communicator

BeautifuL! Thank you.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...