I have the following query to generate a list of the top 5 clients by volume percentage:
index=volume_hourly_summary report="keyvolumebyhour" | timechart span=1w sum(count) by clientkey limit=5| untable _time clientkey count|eventstats sum(count) as Total by _time|eval clientpercent=round(count*100/Total,2)| table _time,clientkey clientpercent| xyseries _time clientkey clientpercent
I have tried to get the results to be sorted by client percentage, but the output is always sorted by clientkey.
Any ideas?
Thanks in advance for your help!!
there is problem in your request
sum(count) the field count doesnt exist so you wont get any interesting result
If the output is always sorted by clientkey, its because of this: "timechart span=1w sum(count) by clientkey limit=5"
To have them sorted by Clientpercent you need have a count by Clientpercent n your request
Hi tmurray3 ,
try use the sort command as below
index=volume_hourly_summary report="keyvolumebyhour" | timechart span=1w sum(count) by clientkey limit=5| untable _time clientkey count|eventstats sum(count) as Total by _time|eval clientpercent=round(count*100/Total,2)| table _time,clientkey clientpercent| xyseries _time clientkey clientpercent |sort -Clientpercent
sort -Clientpercent to sort in descending order
With current query you're getting top 5 clientkey for every week and the clientkey may be different in every week. How many columns you get in the final result?