Splunk Search

How to display column results in descending order?

It shows the result in the below format

uri          208         400  
...            ....             ...

I want to show those uri's on top which has maximum responseCodes, I tried using the below query but it is not giving the desired output.

host="*prod*" uri="*v*" earliest = -7d@d
| WHERE responseCode != 200 
| chart count by uri, responseCode
| sort -responseCode

Sort is not giving results in descending order.

0 Karma
1 Solution

Contributor

Hi Prannoy,

Try adding desc in your search, please try the one below.

host="prod" uri="v" earliest = -7d@d
| WHERE responseCode != 200
| chart count by uri, responseCode
| sort responseCode desc

Let me know if it helps.

View solution in original post

0 Karma

Contributor

Hi Prannoy,

Try adding desc in your search, please try the one below.

host="prod" uri="v" earliest = -7d@d
| WHERE responseCode != 200
| chart count by uri, responseCode
| sort responseCode desc

Let me know if it helps.

View solution in original post

0 Karma

I tried implementing it, but still I am not getting the desired result.
I was thinking to do the sum of columns and then sort the sum, but am not able to implement it effectively.

0 Karma

Champion

hmm what happens if you try this <your query>| addtotals | sort - Total

0 Karma

New Member

Hello,
Am facing similar kind of issue where i need to sort the time column with the latest time.
Will sorting works with column header time value using chart command?

0 Karma

yes, it is working.
Thank You 🙂

0 Karma