How to sort total when using eval case to create chart?

[jwalzerpitt]

I have the following search that shows the top 10 hosts by count of vulnerability categories:

index=foo
| stats count as Count by security_group_name, severity 
| chart useother=true first(Count) over security_group_name by severity 
| eval total=case(critical>0 AND high>0,critical+high,critical>0,critical,high>0,high,1==1,0) 
| eval subTotal=case(medium>0 AND low>0,medium+low,medium>0,medium,low>0,low,1==1,0) 
| sort 10 - subTotal,subSubTotal,total 
| fields - subTotal,subSubTotal,total
| table "security_group_name",critical,high,medium,low

This issue with my chart is that the results are not sorted by the overall total so I see the following results:

splunk chart.JPG

How do I modify my search to sort by overall count/total?

Thx

[johnhuang · Accepted solution]

Add this to the end of your query:

| addtotals | sort - Total | fields - Total

[jwalzerpitt]

TYVM as that solved the issue - I was messing around with the | addtotals command but just had it in the wrong place

Thx again!