https://community.splunk.com/t5/Splunk-Search/Sorting-the-stats-values-results-by-count-and-include-count-in/m-p/199562#M57785 <P>Keep the <CODE>values(cs_User_Agent_)</CODE> untouched. That way you get the distinct count and the values, sort by distinct count, throw away the distinct count.</P> Tue, 17 Jun 2014 15:56:31 GMT martin_mueller 2014-06-17T15:56:31Z https://community.splunk.com/t5/Splunk-Search/Sorting-the-stats-values-results-by-count-and-include-count-in/m-p/199557#M57780 <P>I am trying to get a search result that shows a single IP associated with all of its user agents, but I would like the IP's sorted by the overall amount of hits rather than sorted by numerical order. I would also like to be able to see the count of hits in the end result as well. Thanks in advance!</P> <P><STRONG>My current search:</STRONG></P> <P><CODE>index="logs" source="mywebsite.com" | stats values(cs_User_Agent_) as cs_User_Agent_ by c_ip</CODE></P> <P><STRONG>Right now it results:</STRONG></P> <P>IP: 11.00.00.00<BR /><BR /> User Agent: 1. Mozilla/5.0...<BR /> 2. Mozilaa/4.0...</P> <P>IP: 22.00.00.00<BR /><BR /> User Agent: 1. Mozilla/5.0...</P> <P>IP: 33.00.00.00<BR /><BR /> User Agent: 1. Mozilla/5.0...<BR /> 2. Mozilaa/4.0...<BR /> 3. Mozilla/5.0...</P> <P><STRONG>I am looking to get results like:</STRONG></P> <P>IP: 64.00.00.00 - Count: 13451<BR /><BR /> User Agent: 1. Mozilla/5.0...<BR /> 2. Mozilaa/4.0...</P> <P>IP: 109.00.00.00 - Count: 636<BR /><BR /> User Agent: 1. Mozilla/5.0...</P> <P>IP: 72.00.00.00 - Count: 122<BR /><BR /> User Agent: 1. Mozilla/5.0...<BR /> 2. Mozilaa/4.0...<BR /> 3. Mozilla/5.0...</P> Tue, 17 Jun 2014 15:18:39 GMT https://community.splunk.com/t5/Splunk-Search/Sorting-the-stats-values-results-by-count-and-include-count-in/m-p/199557#M57780 soundchaos 2014-06-17T15:18:39Z https://community.splunk.com/t5/Splunk-Search/Sorting-the-stats-values-results-by-count-and-include-count-in/m-p/199558#M57781 <P>Try something like this:</P> <PRE><CODE>index="logs" source="mywebsite.com" | stats count values(cs_User_Agent_) as cs_User_Agent_ by c_ip </CODE></PRE> <P>You'll get three fields - the IP, the count per IP, and the user agents.</P> Tue, 17 Jun 2014 15:26:43 GMT https://community.splunk.com/t5/Splunk-Search/Sorting-the-stats-values-results-by-count-and-include-count-in/m-p/199558#M57781 martin_mueller 2014-06-17T15:26:43Z https://community.splunk.com/t5/Splunk-Search/Sorting-the-stats-values-results-by-count-and-include-count-in/m-p/199559#M57782 <P>Thanks! That was way easier than everything I have been trying for the last hour... Would you also have any ideas on how I might sort these results based on how many user agents each IP has, without changing the format of the results? I thought something like | sort -mvcount(cs_User_Agent_) might work, but it does not.</P> Mon, 28 Sep 2020 16:52:32 GMT https://community.splunk.com/t5/Splunk-Search/Sorting-the-stats-values-results-by-count-and-include-count-in/m-p/199559#M57782 soundchaos 2020-09-28T16:52:32Z https://community.splunk.com/t5/Splunk-Search/Sorting-the-stats-values-results-by-count-and-include-count-in/m-p/199560#M57783 <P>You can add <CODE>dc(cs_User_Agent_) as dc</CODE> to the <CODE>stats</CODE> and run <CODE>| sort - dc | fields - dc</CODE> at the end.</P> Tue, 17 Jun 2014 15:44:29 GMT https://community.splunk.com/t5/Splunk-Search/Sorting-the-stats-values-results-by-count-and-include-count-in/m-p/199560#M57783 martin_mueller 2014-06-17T15:44:29Z https://community.splunk.com/t5/Splunk-Search/Sorting-the-stats-values-results-by-count-and-include-count-in/m-p/199561#M57784 <P>If I am doing it right, that lists just the number of agents used, instead of each individual agent? I was hoping to be able to sort exactly like this, except for showing the full text of each user agent, rather than just the number of how many. Sorry that I am using the comment for an entirely different question <span class="lia-unicode-emoji" title=":confused_face:">😕</span></P> Tue, 17 Jun 2014 15:54:21 GMT https://community.splunk.com/t5/Splunk-Search/Sorting-the-stats-values-results-by-count-and-include-count-in/m-p/199561#M57784 soundchaos 2014-06-17T15:54:21Z https://community.splunk.com/t5/Splunk-Search/Sorting-the-stats-values-results-by-count-and-include-count-in/m-p/199562#M57785 <P>Keep the <CODE>values(cs_User_Agent_)</CODE> untouched. That way you get the distinct count and the values, sort by distinct count, throw away the distinct count.</P> Tue, 17 Jun 2014 15:56:31 GMT https://community.splunk.com/t5/Splunk-Search/Sorting-the-stats-values-results-by-count-and-include-count-in/m-p/199562#M57785 martin_mueller 2014-06-17T15:56:31Z