Security

How to edit my search to get the top 20 browsers by distinct user in descending order?

Explorer

I've managed to get the search to work a couple ways, but most of what I've seen suggests I need something similar to this. All I can't get to work is the descending order, which seems like it should be simple. Thoughts?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try the following instead:

| stats dc(UID) as count by browser 
| sort 20 -num(count)

View solution in original post

SplunkTrust
SplunkTrust

Try the following instead:

| stats dc(UID) as count by browser 
| sort 20 -num(count)

View solution in original post

Explorer

This works. Thank you!

0 Karma