https://community.splunk.com/t5/Splunk-Search/How-do-I-sort-this-stats-count/m-p/362538#M107107 <P>Because there are fewer than 1000 Countries, this will work just fine but the default for <CODE>sort</CODE> is equivalent to <CODE>sort 1000</CODE> so EVERYONE should ALWAYS be in the habit of using <CODE>sort 0</CODE> (unlimited) instead, as in <CODE>sort 0 - count</CODE> or your results will be silently truncated to the first 1000.</P> Fri, 11 Aug 2017 23:24:55 GMT woodcock 2017-08-11T23:24:55Z https://community.splunk.com/t5/Splunk-Search/How-do-I-sort-this-stats-count/m-p/362536#M107105 <P>This is my search below. It shows Country and count. How do I sort the count field for largest to smallest?</P> <PRE><CODE>index="cisco_asa" src_ip="*" dest_port="*" action="blocked" | fields src_ip | iplocation src_ip | stats count by Country </CODE></PRE> Thu, 10 Aug 2017 23:54:41 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-sort-this-stats-count/m-p/362536#M107105 bayman 2017-08-10T23:54:41Z https://community.splunk.com/t5/Splunk-Search/How-do-I-sort-this-stats-count/m-p/362537#M107106 <P>Add the following to the end of your search:</P> <PRE><CODE>your search....| sort -count </CODE></PRE> Fri, 11 Aug 2017 03:00:02 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-sort-this-stats-count/m-p/362537#M107106 kmorris_splunk 2017-08-11T03:00:02Z https://community.splunk.com/t5/Splunk-Search/How-do-I-sort-this-stats-count/m-p/362538#M107107 <P>Because there are fewer than 1000 Countries, this will work just fine but the default for <CODE>sort</CODE> is equivalent to <CODE>sort 1000</CODE> so EVERYONE should ALWAYS be in the habit of using <CODE>sort 0</CODE> (unlimited) instead, as in <CODE>sort 0 - count</CODE> or your results will be silently truncated to the first 1000.</P> Fri, 11 Aug 2017 23:24:55 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-sort-this-stats-count/m-p/362538#M107107 woodcock 2017-08-11T23:24:55Z https://community.splunk.com/t5/Splunk-Search/How-do-I-sort-this-stats-count/m-p/362539#M107108 <P>that's a good one to keep in mind!</P> Fri, 11 Aug 2017 23:25:57 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-sort-this-stats-count/m-p/362539#M107108 santiagoaloi 2017-08-11T23:25:57Z https://community.splunk.com/t5/Splunk-Search/How-do-I-sort-this-stats-count/m-p/362540#M107109 <P>This is one of the most common gotchas I see among our users. Sure wish splunk would add some sort of tool tip or notification when such limits kick in.</P> Fri, 11 Aug 2017 23:29:59 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-sort-this-stats-count/m-p/362540#M107109 dstaulcu 2017-08-11T23:29:59Z https://community.splunk.com/t5/Splunk-Search/How-do-I-sort-this-stats-count/m-p/362541#M107110 <P>Just an update, default is now <CODE>10000</CODE> now <CODE>1000</CODE></P> Fri, 21 Jun 2019 09:01:22 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-sort-this-stats-count/m-p/362541#M107110 DavidHourani 2019-06-21T09:01:22Z