Splunk Search

Difficulty sorting a field by another field

aputz
Path Finder

I previously had a query on grouping results from a search and I received a great deal of help in shaping this query. I did not realize until after applying the search string that it wasn't quite ordering the results as I had thought. The following query sorts reverse alphabetically followed by descending order of bandwidth taken by each destination IP within the app. I am working with the following search string:

index=traffic report=AppsDst | eval MegaBits=round((nbytes*(8/3600))*pow(10,-6),2) | stats sum(MegaBits) as MegaBits_per_Sec by app, dst | sort - app MegaBits_per_Sec | streamstats current=f last(app) as previousApp | eval app=if(match(app,previousApp),"",app)| fields - previousApp | rename app as Application, dst as Destination_IP

Ideally I would like to have the apps sorted first separately by their respective bandwidths, then they are broken out by the bandwidth of each IP within the Apps. I currently have a working dashboard with these two aspects separated via a drill-down. The following searches are within the dashboard:

index=traffic report=AppsDst | eval MegaBits=(nbytes*(8/3600))*pow(10,-6) | stats sum(MegaBits) as MegaBits_per_Sec by app | sort -MegaBits_per_Sec

When an application is selected it displays a drilldown table below with the following search:

index=traffic report=AppsDst | eval MegaBits_per_Sec=(nbytes*(8/3600))*pow(10,-6) | stats sum(MegaBits_per_Sec) as MegaBits_per_Sec by dst | sort -MegaBits_per_Sec | rename dst as Destination_IP

I am at mental roadblock trying to figure out if it is possible to integrate the organization/formatting from the drilldown tables into a single search string. The issue with the first search string is that it isn't sorting the apps field based on the MegaBits_per_Sec field. Any help is greatly appreciated as the current drilldown dashboard I have is not as accommodating for extraction via CSV.

Thank you for any help,

Alex

cpride_splunk
Splunk Employee
Splunk Employee

I think you could do this with an eventstats:

index=traffic report=AppsDst | eval MegaBits=(nbytes*(8/3600))*pow(10,-6) | stats sum(MegaBits) as MegaBits_per_Sec by app, dst | eventstats sum(MegaBits_per_Sec) as AppMegaBits_per_Sec by app | sort -AppMegaBits_per_Sec -MegaBits_per_Sec | fields app, dst, MegaBits_per_Sec
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...