My query ends with
| stats count(_raw) by user
I want the values to be displayed in descending order based on the "count(_raw)' values.
Hi @zacksoft,
Try below query
<yourBaseSearch>
| stats count(_raw) as count by user
| sort limit=10 -count
hi @zacksoft
Did the answer below solve your problem? If so, please resolve this post by approving it!
If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!
Hi @zacksoft,
Try below query
<yourBaseSearch>
| stats count(_raw) as count by user
| sort limit=10 -count