How to sort a report to give me top 20 MAX values?

[sraguan]

I have a report that showing me the top 20 of field called "sc_bytes" (By count),

> > source="xap.csv" | top limit=20 sc_bytes

So this is what I get:

sc_bytes cs_uri_stem Count percent
992 /messagebroker/amfpolling.wlforward 433769 16.32443
1245 /messagebroker/amfpolling.wlforward 72714 14.026691
276 /messagebroker/amfpolling.wlforward 217028 8.167615
927 /messagebroker/amfpolling.wlforward 119193 4.4857

but I want to see the top 20 of field called "sc_bytes" By the MAXIMUM value of the field itself and not by count.
So it will look like this:

sc_bytes cs_uri_stem Count percent
1245 /messagebroker/amfpolling.wlforward 72714 14.026691
992 /messagebroker/amfpolling.wlforward 433769 16.32443
927 /messagebroker/amfpolling.wlforward 119193 4.4857
276 /messagebroker/amfpolling.wlforward 217028 8.167615

[sraguan · Accepted solution]

got it:

source="xap.csv"  | fields sc_bytes | sort -sc_bytes  | head 20| top limit=20 sc_bytes

[richgalloway]

It looks like your second example is just a re-sort of your first example. If that's all you need then add a sort to your search: source="xap.csv" | top limit=20 sc_bytes | sort -sc_bytes

[sraguan]

Thanks @richgalloway ,
the sort really did sorted the top 20 but I have 2 million events in this search and he sorted the top 20 that had the highest count.
I want to sort the top 20 events that has the highest (MAX) sc_bytes.

[esix_splunk]

This perhaps?

.... | stats count max(sc_bytes) as max | top limit=20 max

[sraguan]

@esix_splunk,
I tried what you suggested but stat max only give you 1 value which is the highest one,
it can't give you multiple values (20) like I want.

[esix_splunk]

Yes, need to group this by something. Such as host, interface, etc..

[sraguan]

I'm not sure i'm getting what you are saying (newbie in splunk),
is there a group command?
or even better - can you please write the search query that can give me the output that I want?