Splunk Search

Difficulty sorting a field by another field

Path Finder

I previously had a query on grouping results from a search and I received a great deal of help in shaping this query. I did not realize until after applying the search string that it wasn't quite ordering the results as I had thought. The following query sorts reverse alphabetically followed by descending order of bandwidth taken by each destination IP within the app. I am working with the following search string:

index=traffic report=AppsDst | eval MegaBits=round((nbytes(8/3600))pow(10,-6),2) | stats sum(MegaBits) as MegaBitsperSec by app, dst | sort - app MegaBitsperSec | streamstats current=f last(app) as previousApp | eval app=if(match(app,previousApp),"",app)| fields - previousApp | rename app as Application, dst as Destination_IP

Ideally I would like to have the apps sorted first separately by their respective bandwidths, then they are broken out by the bandwidth of each IP within the Apps. I currently have a working dashboard with these two aspects separated via a drill-down. The following searches are within the dashboard:

index=traffic report=AppsDst | eval MegaBits=(nbytes(8/3600))pow(10,-6) | stats sum(MegaBits) as MegaBitsperSec by app | sort -MegaBitsperSec

When an application is selected it displays a drilldown table below with the following search:

index=traffic report=AppsDst | eval MegaBitsperSec=(nbytes(8/3600))pow(10,-6) | stats sum(MegaBitsperSec) as MegaBitsperSec by dst | sort -MegaBitsperSec | rename dst as Destination_IP

I am at mental roadblock trying to figure out if it is possible to integrate the organization/formatting from the drilldown tables into a single search string. The issue with the first search string is that it isn't sorting the apps field based on the MegaBitsperSec field. Any help is greatly appreciated as the current drilldown dashboard I have is not as accommodating for extraction via CSV.

Thank you for any help,



Re: Difficulty sorting a field by another field

Splunk Employee
Splunk Employee

I think you could do this with an eventstats:

index=traffic report=AppsDst | eval MegaBits=(nbytes*(8/3600))*pow(10,-6) | stats sum(MegaBits) as MegaBits_per_Sec by app, dst | eventstats sum(MegaBits_per_Sec) as AppMegaBits_per_Sec by app | sort -AppMegaBits_per_Sec -MegaBits_per_Sec | fields app, dst, MegaBits_per_Sec
0 Karma