I have a query of the form
'stats list(body) AS events BY id
Which gives me for example:
id body
1 jack
2 foo
bar
joe
3 sun
moon
I would like this to be sorted according to the size of each group, i.e., the output should be
id body
2 foo
bar
joe
3 sun
moon
1 jack
How would I achieve this?
Try like this
your base search | stats list(body) AS events BY id | eval t=mvcount(events) | sort -t | fields -t
Try like this
your base search | stats list(body) AS events BY id | eval t=mvcount(events) | sort -t | fields -t
Nice thanks, should the last part of your query maybe be sort -t | table id events -t
?