https://community.splunk.com/t5/Splunk-Search/order-result-High-to-Low/m-p/482212#M135095 <P>perfect! worked like a charm. </P> Mon, 16 Sep 2019 23:53:17 GMT sdewar83 2019-09-16T23:53:17Z https://community.splunk.com/t5/Splunk-Search/order-result-High-to-Low/m-p/482210#M135093 <P>I have a simple query, listing event codes by host:</P> <P>index=wineventlog sourcetype=WinEventLog:Security<BR /> Stats count by EventCode, host</P> <P>I'd like to order the results so that it shows either the top 10 highest count event codes (e.g 100 of 4625, 80 of 4264, etc) per host.<BR /> Or at least displays the count column in a highest to lowest fashion, per host. At the moment it displays all the info, but in no specific ordering. I'd like it to be more readily obvious which are the most common errors happening on hosts in t he time period i'm searching.</P> <P>Any assistance appreciated!</P> Mon, 16 Sep 2019 02:14:14 GMT https://community.splunk.com/t5/Splunk-Search/order-result-High-to-Low/m-p/482210#M135093 sdewar83 2019-09-16T02:14:14Z https://community.splunk.com/t5/Splunk-Search/order-result-High-to-Low/m-p/482211#M135094 <P>so you add this - <CODE>sort host,- count</CODE></P> Mon, 16 Sep 2019 11:14:58 GMT https://community.splunk.com/t5/Splunk-Search/order-result-High-to-Low/m-p/482211#M135094 Sukisen1981 2019-09-16T11:14:58Z https://community.splunk.com/t5/Splunk-Search/order-result-High-to-Low/m-p/482212#M135095 <P>perfect! worked like a charm. </P> Mon, 16 Sep 2019 23:53:17 GMT https://community.splunk.com/t5/Splunk-Search/order-result-High-to-Low/m-p/482212#M135095 sdewar83 2019-09-16T23:53:17Z