Security

How to edit my search to get the top 20 browsers by distinct user in descending order?

ON34C02151009
Explorer

I've managed to get the search to work a couple ways, but most of what I've seen suggests I need something similar to this. All I can't get to work is the descending order, which seems like it should be simple. Thoughts?

0 Karma
1 Solution

javiergn
Super Champion

Try the following instead:

| stats dc(UID) as count by browser 
| sort 20 -num(count)

View solution in original post

javiergn
Super Champion

Try the following instead:

| stats dc(UID) as count by browser 
| sort 20 -num(count)

ON34C02151009
Explorer

This works. Thank you!

0 Karma
Get Updates on the Splunk Community!

Customer Experience | Splunk 2024: New Onboarding Resources

In 2023, we were routinely reminded that the digital world is ever-evolving and susceptible to new ...

Celebrate CX Day with Splunk: Take our interactive quiz, join our LinkedIn Live ...

Today and every day, Splunk celebrates the importance of customer experience throughout our product, ...

How to Get Started with Splunk Data Management Pipeline Builders (Edge Processor & ...

If you want to gain full control over your growing data volumes, check out Splunk’s Data Management pipeline ...