Security

How to edit my search to get the top 20 browsers by distinct user in descending order?

ON34C02151009
Explorer

I've managed to get the search to work a couple ways, but most of what I've seen suggests I need something similar to this. All I can't get to work is the descending order, which seems like it should be simple. Thoughts?

0 Karma
1 Solution

javiergn
Super Champion

Try the following instead:

| stats dc(UID) as count by browser 
| sort 20 -num(count)

View solution in original post

javiergn
Super Champion

Try the following instead:

| stats dc(UID) as count by browser 
| sort 20 -num(count)

ON34C02151009
Explorer

This works. Thank you!

0 Karma
Get Updates on the Splunk Community!

How to Get Started with Splunk Data Management Pipeline Builders (Edge Processor & ...

If you want to gain full control over your growing data volumes, check out Splunk’s Data Management pipeline ...

Out of the Box to Up And Running - Streamlined Observability for Your Cloud ...

  Tech Talk Streamlined Observability for Your Cloud Environment Register    Out of the Box to Up And Running ...

Splunk Smartness with Brandon Sternfield | Episode 3

Hello and welcome to another episode of "Splunk Smartness," the interview series where we explore the power of ...