topic Re: How to display column results in descending order? in Splunk Search

How to display column results in descending order?

prannoy93singh — Wed, 27 Jun 2018 16:55:46 GMT

It shows the result in the below format

uri          208         400  
...            ....             ...

I want to show those uri's on top which has maximum responseCodes, I tried using the below query but it is not giving the desired output.

host="*prod*" uri="*v*" earliest = -7d@d
| WHERE responseCode != 200 
| chart count by uri, responseCode
| sort -responseCode

Sort is not giving results in descending order.

Re: How to display column results in descending order?

pruthvikrishnap — Wed, 27 Jun 2018 17:40:42 GMT

Hi Prannoy,

Try adding desc in your search, please try the one below.

host="prod" uri="v" earliest = -7d@d
| WHERE responseCode != 200
| chart count by uri, responseCode
| sort responseCode desc

Let me know if it helps.

Re: How to display column results in descending order?

prannoy93singh — Wed, 27 Jun 2018 17:54:35 GMT

I tried implementing it, but still I am not getting the desired result.
I was thinking to do the sum of columns and then sort the sum, but am not able to implement it effectively.

Re: How to display column results in descending order?

Sukisen1981 — Wed, 27 Jun 2018 18:29:09 GMT

hmm what happens if you try this <your query>| addtotals | sort - Total

Re: How to display column results in descending order?

prannoy93singh — Wed, 27 Jun 2018 20:22:41 GMT

yes, it is working.
Thank You 🙂

Re: How to display column results in descending order?

arunrajamani — Mon, 25 Nov 2019 00:30:55 GMT

Hello,
Am facing similar kind of issue where i need to sort the time column with the latest time.
Will sorting works with column header time value using chart command?