Splunk Search

How to sort a table based on two columns in order of priority?

DavidHourani
Super Champion

Hello dear Splunkers,

I have a table showing the amount of downloaded data per website by user on my network.

Is it possible to sort this table based on two fields? I need the "sort" to put priority on the total downloaded amount per user and then the total amount downloaded per website.

This means there will be two sorts: the first sort will fix up all the users that downloaded the most in a way to get the user that downloaded the most on top of the list (regardless of the webpages the accessed). The second sort will set the most bandwidth consuming webpage per user in order. That makes the table show the top users and top websites per top users (hope that's not too complicated).

Here are the fields being used:
User : The user
webpage : The accessed webpage
BWu : Bandwidth per User
BWs : Bandwidth per webpage

Regards,
David

Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

You can stack sort arguments like this:

...
| sort 0 -BWu -BWs

But what I suspect you really desire is something like this:

...
| sort 0 -count
| stats list(BWs) AS BWs list(webpage) AS webpage sum(BWs) AS BWu BY User
| sort 0 -BWu

View solution in original post

woodcock
Esteemed Legend

You can stack sort arguments like this:

...
| sort 0 -BWu -BWs

But what I suspect you really desire is something like this:

...
| sort 0 -count
| stats list(BWs) AS BWs list(webpage) AS webpage sum(BWs) AS BWu BY User
| sort 0 -BWu

jrouse025
Path Finder

|sort -BWu -BWs +Username

chimell
Motivator

Hi DavidHourani
try this search code

.....|stats count by User webpage |top limit=0 User webpage |appendcols[search .....|stats count by BWu BWs  |top limit=0  BWu BWs]

gyslainlatsa
Motivator

hi DavidHourani,

you search corresponding |stats count by field1, field2, field3, field4 |sort -count
0 Karma

DavidHourani
Super Champion

Thanks for your reply Gys, I need to have double sorting, one based on BWu and one on BWs, in your case I only have sorting on count right ?

0 Karma

gyslainlatsa
Motivator

try like this: you search corresponding |stats count by BWu , BWs |sort -count

0 Karma

DavidHourani
Super Champion

Thanks for the tip, it doesn't work though. The sort should be based on BWu and BWs not on the count. because the count is equal to 1 for all the values 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...