https://community.splunk.com/t5/Splunk-Search/How-to-sort-list-by-size-of-group-by/m-p/215917#M63324 <P>I have a query of the form</P> <PRE><CODE>'stats list(body) AS events BY id </CODE></PRE> <P>Which gives me for example:</P> <PRE><CODE>id body 1 jack 2 foo bar joe 3 sun moon </CODE></PRE> <P>I would like this to be sorted according to the size of each group, i.e., the output should be </P> <PRE><CODE> id body 2 foo bar joe 3 sun moon 1 jack </CODE></PRE> <P>How would I achieve this?</P> Wed, 09 Nov 2016 20:53:17 GMT viggor 2016-11-09T20:53:17Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-list-by-size-of-group-by/m-p/215917#M63324 <P>I have a query of the form</P> <PRE><CODE>'stats list(body) AS events BY id </CODE></PRE> <P>Which gives me for example:</P> <PRE><CODE>id body 1 jack 2 foo bar joe 3 sun moon </CODE></PRE> <P>I would like this to be sorted according to the size of each group, i.e., the output should be </P> <PRE><CODE> id body 2 foo bar joe 3 sun moon 1 jack </CODE></PRE> <P>How would I achieve this?</P> Wed, 09 Nov 2016 20:53:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-list-by-size-of-group-by/m-p/215917#M63324 viggor 2016-11-09T20:53:17Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-list-by-size-of-group-by/m-p/215918#M63325 <P>Try like this</P> <PRE><CODE>your base search | stats list(body) AS events BY id | eval t=mvcount(events) | sort -t | fields -t </CODE></PRE> Wed, 09 Nov 2016 20:59:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-list-by-size-of-group-by/m-p/215918#M63325 somesoni2 2016-11-09T20:59:40Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-list-by-size-of-group-by/m-p/215919#M63326 <P>Nice thanks, should the last part of your query maybe be <CODE>sort -t | table id events -t</CODE> ?</P> Wed, 09 Nov 2016 21:04:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-list-by-size-of-group-by/m-p/215919#M63326 viggor 2016-11-09T21:04:08Z