I've managed to get the search to work a couple ways, but most of what I've seen suggests I need something similar to this. All I can't get to work is the descending order, which seems like it should be simple. Thoughts?
Try the following instead:
| stats dc(UID) as count by browser
| sort 20 -num(count)
Try the following instead:
| stats dc(UID) as count by browser
| sort 20 -num(count)
This works. Thank you!