Why isn't the following chart query sorting by amount of threats?

[Yaichael]

Good day,

I've have created the following query for displaying the amount of critical threats reported
by device, but it's only sorting by the Total field, and not by the amount of threats in every bar.

tag::critical sourcetype=syslog 
| chart count over device by threat limit=0 usenull=f useother=f
| addtotals
| sort -Total
| fields - Total
| head 5
| rename device as Devices

How do I achieve this?

Thanks!

[somesoni2]

Your chart shows count of each threat for each device reporting. Since not all threats are reported from all devices, if you sort by one threat, the sorting order will be different in other threat, so sorting by Total (which your query does) seems like better option. If that's not correct, could you please explain what's your expected output is, possible with some sample example.

[Yaichael]

Thanks for the reply.

My query sorts by the total of threats for each device, which is on the x axis of the chart, but I would like to also sort by the total amount of each individual threat on those devices on the y axis.

[somesoni2]

You basically want to order the column of each threat for each device based on count value for each threat. The problem is that they appear in the order of listing in the table visualization and listing order applies to all row. If you sort for each device, the column order will vary for each row hence that won't be possible.

See if something like this is acceptable:

 tag::critical sourcetype=syslog 
 | chart count over device by threat limit=0 usenull=f useother=f
 | addtotals
 | sort -Total
 | fields - Total
 | head 5
 | rename device as Devices
 | untable Devices threat count
 | eval Devices=Devices."-".threat | fields - threat
 | sort Devices -count

[Yaichael]

Alright, if it isn't possible, I'll use your query.

Thank you!