topic Re: show table results in descending count order in Splunk Search

show table results in descending count order

bcusick — Mon, 28 Sep 2020 16:09:28 GMT

Hi,

I'm thinking this has a simple solution..Is there anyway to show a table in descending order by count? Currently it always goes alphabetically.

Now:

Anthony        6
Brian          8
Michael        4

I would like to see:

Brian          8
Anthony        6
Michael        4

The way I'm currently outputting this is ` | stats count by login_name, year_day | stats count AS "Number of days Logged in" by login_name

richgalloway — Mon, 17 Mar 2014 13:17:17 GMT

Maybe ' ... | sort - "Number of days Logged in"' ?

bcusick — Mon, 17 Mar 2014 13:22:43 GMT

BeautifuL! Thank you.

w531t4 — Mon, 28 Nov 2016 18:11:37 GMT

I downvoted this post because does not work on datasets larger than 10000 rows

vasanthmss — Mon, 28 Nov 2016 18:32:52 GMT

use the below one,

| sort 0 - "Number of days Logged in"

while using sort you can mention the limitation, zero means there will not be any limits applied. 😉

helge — Wed, 15 Feb 2017 22:55:35 GMT

Add limit=0 to remove the limitation to 10,000 rows