https://community.splunk.com/t5/Dashboards-Visualizations/How-to-sort-total-when-using-eval-case-to-create-chart/m-p/616558#M50625 <P>Add this to the end of your query:</P><LI-CODE lang="markup">| addtotals | sort - Total | fields - Total</LI-CODE> Mon, 10 Oct 2022 16:54:57 GMT johnhuang 2022-10-10T16:54:57Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-sort-total-when-using-eval-case-to-create-chart/m-p/616538#M50622 <P>I have the following search that shows the top 10 hosts by count of vulnerability categories:</P><LI-CODE lang="markup">index=foo | stats count as Count by security_group_name, severity | chart useother=true first(Count) over security_group_name by severity | eval total=case(critical&gt;0 AND high&gt;0,critical+high,critical&gt;0,critical,high&gt;0,high,1==1,0) | eval subTotal=case(medium&gt;0 AND low&gt;0,medium+low,medium&gt;0,medium,low&gt;0,low,1==1,0) | sort 10 - subTotal,subSubTotal,total | fields - subTotal,subSubTotal,total | table "security_group_name",critical,high,medium,low</LI-CODE><P>This issue with my chart is that the results are not sorted by the overall total so I see the following results:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="splunk chart.JPG" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/21961i5AA410813AF5D6FE/image-size/large?v=v2&amp;px=999" role="button" title="splunk chart.JPG" alt="splunk chart.JPG" /></span></P><P>How do I modify my search to sort by overall count/total?</P><P>Thx</P> Mon, 10 Oct 2022 14:49:00 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-sort-total-when-using-eval-case-to-create-chart/m-p/616538#M50622 jwalzerpitt 2022-10-10T14:49:00Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-sort-total-when-using-eval-case-to-create-chart/m-p/616558#M50625 <P>Add this to the end of your query:</P><LI-CODE lang="markup">| addtotals | sort - Total | fields - Total</LI-CODE> Mon, 10 Oct 2022 16:54:57 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-sort-total-when-using-eval-case-to-create-chart/m-p/616558#M50625 johnhuang 2022-10-10T16:54:57Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-sort-total-when-using-eval-case-to-create-chart/m-p/616574#M50627 <P>TYVM as that solved the issue - I was messing around with the | addtotals command but just had it in the wrong place</P><P>Thx again!</P> Mon, 10 Oct 2022 20:53:27 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-sort-total-when-using-eval-case-to-create-chart/m-p/616574#M50627 jwalzerpitt 2022-10-10T20:53:27Z