Sort by event count

rockb — Thu, 18 Nov 2021 20:24:25 GMT

I have panel on a dashboard that lists events in a security log. I can list them by Event ID but I would like it listed by Event ID count so that the most frequent are at the top. If I change "count by Event" to "count by count" I get an error "The output field 'count ' cannot have the same name as a group by field."

<query>index="wineventlog" $Site_Token$ $Cmptr_Token$ $Type$ LogName="Security" Type=Information | stats count by Event</query>

How do I get it to list them in descending order by count?

Re: Sort by event count

richgalloway — Thu, 18 Nov 2021 20:57:33 GMT

Counting and ordering are different operations. Once you have the count, put the results in order using the sort command.

<query>index="wineventlog" $Site_Token$ $Cmptr_Token$ $Type$ LogName="Security" Type=Information | stats count by Event | sort 0 - count</query>

topic Re: Sort by event count in Dashboards & Visualizations

Sort by event count

Re: Sort by event count