https://community.splunk.com/t5/Splunk-Search/Sorting-a-list/m-p/198392#M57356 <P>Hi Splunkers!</P> <P>My data looks like this - it may be familiar from a recent high-profile data leak <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>phone number, username, location<BR /> 21209864XX, user001, london</P> <P>My hypothesis is to test wether a phonenumber has created more than one account, which in theory should be impossible.</P> <P>I want to see a table of phonenumbers and the usernames linked to them, sorted by the phonenumbers that are linked to the most usernames (hopefully that makes sense!)</P> <P>I have run a search to group all usernames that share the same phonenumber.</P> <P>index="sandbox" | stats list(phonenumber) by username</P> <P>I want to sort the resulting table by the lists which contain the most usernames. The search below returns the number of events a unique phonenumber can be found, hence the amount of usernames it is connected too.</P> <P>index="sandbox" | stats count(phonenumber) by phonenumber | sort -count(phonenumber)</P> <P>What I'm struggling to do is link to two together, to sort the listed table. Can anyone help?</P> <P>Thanks!</P> Wed, 08 Jan 2014 20:46:13 GMT himynamesdave 2014-01-08T20:46:13Z https://community.splunk.com/t5/Splunk-Search/Sorting-a-list/m-p/198392#M57356 <P>Hi Splunkers!</P> <P>My data looks like this - it may be familiar from a recent high-profile data leak <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>phone number, username, location<BR /> 21209864XX, user001, london</P> <P>My hypothesis is to test wether a phonenumber has created more than one account, which in theory should be impossible.</P> <P>I want to see a table of phonenumbers and the usernames linked to them, sorted by the phonenumbers that are linked to the most usernames (hopefully that makes sense!)</P> <P>I have run a search to group all usernames that share the same phonenumber.</P> <P>index="sandbox" | stats list(phonenumber) by username</P> <P>I want to sort the resulting table by the lists which contain the most usernames. The search below returns the number of events a unique phonenumber can be found, hence the amount of usernames it is connected too.</P> <P>index="sandbox" | stats count(phonenumber) by phonenumber | sort -count(phonenumber)</P> <P>What I'm struggling to do is link to two together, to sort the listed table. Can anyone help?</P> <P>Thanks!</P> Wed, 08 Jan 2014 20:46:13 GMT https://community.splunk.com/t5/Splunk-Search/Sorting-a-list/m-p/198392#M57356 himynamesdave 2014-01-08T20:46:13Z https://community.splunk.com/t5/Splunk-Search/Sorting-a-list/m-p/198393#M57357 <P>Try following:</P> <PRE><CODE>index="sandbox" | stats list(username) as usernames by phonenumber | eval count=mvcount(usernames) | sort -count </CODE></PRE> Wed, 08 Jan 2014 21:00:03 GMT https://community.splunk.com/t5/Splunk-Search/Sorting-a-list/m-p/198393#M57357 somesoni2 2014-01-08T21:00:03Z