https://community.splunk.com/t5/Splunk-Search/How-to-sort-table-by-total-errors-in-descending-order/m-p/474890#M133514 <P>Hi,<BR /> I have this search and basically it shows a table with the channel. <BR /> Error type, total error, and the sum total of the errors- but I append a sort function at the end to sort by total but it doesn't sort it?</P> <PRE><CODE>index=appguids host=netweba* ApplicationID=order20 ApplicationSource=*order* errorguid Monster.PaymentProcessor.PaymentFailedException | rex field=Message "(?m)^Message:[^:]+:\s(?&lt;type&gt;.*)$" | stats count BY type,ChannelID | lookup local=1 MonsterChannels ChannelId AS ChannelID | eval Channel=if(isnull(Channel) OR match(Channel,"^0$"),"Unknown ChannelID", Channel) . " [ChannelID: " . ChannelID . "]" | stats values(type) AS "Error Type", list(count) AS "#Errors" BY Channel | </CODE></PRE> <P><STRONG>appendpipe [ stats sum("#Errors") AS "#Errors" BY Channel | eval "Error Type"="Total for Channel" ] | stats values(Channel) AS X, list("Error Type") AS "Error Type", list("#Errors") AS "#Errors" BY Channel | fields - X | sort - "Total for Channel"</STRONG></P> Mon, 04 Nov 2019 03:11:06 GMT lsy9891 2019-11-04T03:11:06Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-table-by-total-errors-in-descending-order/m-p/474890#M133514 <P>Hi,<BR /> I have this search and basically it shows a table with the channel. <BR /> Error type, total error, and the sum total of the errors- but I append a sort function at the end to sort by total but it doesn't sort it?</P> <PRE><CODE>index=appguids host=netweba* ApplicationID=order20 ApplicationSource=*order* errorguid Monster.PaymentProcessor.PaymentFailedException | rex field=Message "(?m)^Message:[^:]+:\s(?&lt;type&gt;.*)$" | stats count BY type,ChannelID | lookup local=1 MonsterChannels ChannelId AS ChannelID | eval Channel=if(isnull(Channel) OR match(Channel,"^0$"),"Unknown ChannelID", Channel) . " [ChannelID: " . ChannelID . "]" | stats values(type) AS "Error Type", list(count) AS "#Errors" BY Channel | </CODE></PRE> <P><STRONG>appendpipe [ stats sum("#Errors") AS "#Errors" BY Channel | eval "Error Type"="Total for Channel" ] | stats values(Channel) AS X, list("Error Type") AS "Error Type", list("#Errors") AS "#Errors" BY Channel | fields - X | sort - "Total for Channel"</STRONG></P> Mon, 04 Nov 2019 03:11:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-table-by-total-errors-in-descending-order/m-p/474890#M133514 lsy9891 2019-11-04T03:11:06Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-table-by-total-errors-in-descending-order/m-p/474891#M133515 <PRE><CODE>sort - "Total for Channel" ⇨ sort - "#Errors" </CODE></PRE> <P>Hi, How about this?</P> Mon, 04 Nov 2019 06:49:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-table-by-total-errors-in-descending-order/m-p/474891#M133515 to4kawa 2019-11-04T06:49:05Z