https://community.splunk.com/t5/Splunk-Search/How-to-sort-by-max-value-of-a-dynamic-set-of-columns/m-p/126237#M34178 <P>Try this (may be inefficient) workaround </P> <PRE><CODE>"Your base search giving you output in Above format" | table [search "Your base search giving you output in Above format" | untable "Error Code" SoftwareVersion Count | stats max(Count) as count by SoftwareVersion | sort 0 - count | stats list(SoftwareVersion) as search | nomv search] </CODE></PRE> Fri, 03 Apr 2015 01:21:02 GMT somesoni2 2015-04-03T01:21:02Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-by-max-value-of-a-dynamic-set-of-columns/m-p/126236#M34177 <P>I have a Splunk query that shows a count of error codes by software version. The table looks something like this:</P> <PRE><CODE>Error Code 1.1 1.2 1.3 Error 1 5 0 10 Error 2 7 9 0 Error 3 20 3 8 </CODE></PRE> <P>What I'd like to do is dynamically find the column with the max value across all columns and sort descending on that column. Is that even possible?</P> Thu, 02 Apr 2015 23:59:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-by-max-value-of-a-dynamic-set-of-columns/m-p/126236#M34177 dbendixen 2015-04-02T23:59:32Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-by-max-value-of-a-dynamic-set-of-columns/m-p/126237#M34178 <P>Try this (may be inefficient) workaround </P> <PRE><CODE>"Your base search giving you output in Above format" | table [search "Your base search giving you output in Above format" | untable "Error Code" SoftwareVersion Count | stats max(Count) as count by SoftwareVersion | sort 0 - count | stats list(SoftwareVersion) as search | nomv search] </CODE></PRE> Fri, 03 Apr 2015 01:21:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-by-max-value-of-a-dynamic-set-of-columns/m-p/126237#M34178 somesoni2 2015-04-03T01:21:02Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-by-max-value-of-a-dynamic-set-of-columns/m-p/126238#M34179 <P>I will give this a try, thanks!</P> Fri, 03 Apr 2015 01:40:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-by-max-value-of-a-dynamic-set-of-columns/m-p/126238#M34179 dbendixen 2015-04-03T01:40:24Z