Splunk Search

How do I get top 10 values of output based on "count(_raw)' values displayed in descending order?

zacksoft
Contributor

My query ends with

 | stats count(_raw) by user

 I want the values to be displayed in descending order based on the "count(_raw)' values.
Tags (1)
0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi @zacksoft,

Try below query

<yourBaseSearch>
| stats count(_raw) as count by user
| sort limit=10 -count 

View solution in original post

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @zacksoft

Did the answer below solve your problem? If so, please resolve this post by approving it!
If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

0 Karma

harsmarvania57
Ultra Champion

Hi @zacksoft,

Try below query

<yourBaseSearch>
| stats count(_raw) as count by user
| sort limit=10 -count 
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...