topic Re: sort fields in a column after grouping in Splunk Search

sort fields in a column after grouping

lain179 — Fri, 21 Feb 2014 00:42:37 GMT

I have stats values(A) by B, C and then I want to sort by values of A within each group. A is a numeric value. How can I accomplish that?

I tried stats values(A) as A by B, C | sort A but that's only sorting the groups, not the values within each group in the stats.

somesoni2 — Fri, 21 Feb 2014 14:41:11 GMT

If you're not worried about the count and just want to list values, give this a try.

your base search | stats count by A,B,C | fields - count| sort B,C,num(A) | stats list(A) by B,C

Since duplicates are already removed by first stats, list and values will return same set of data.

lain179 — Fri, 21 Feb 2014 19:07:02 GMT

Awesome!!!! It worked. Thank you.

lain179 — Fri, 21 Feb 2014 19:07:50 GMT

Thanks to somesoni2

base search | stats count by A,B,C | fields - count| sort B,C,num(A) | stats list(A) by B,C