Splunk Search

How to sort by field?

jackpal
Path Finder

I am trying to get the highest used process percentage by user, however, I am unable to sort by the field I want to.

index=os sourcetype=top host=hostname
| chart sum(pctCPU) as CPU_USAGE by USER,COMMAND
| sort sum(pctCPU) desc 
| head 5

This produces a table but I'd like the chart to only show the top 5 users and the commands they are running sorted by their CPU_USAGE

0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust

Does this do it for you?:

index=os sourcetype=top host=hostname
| stats sum(pctCPU) as CPU_USAGE by USER,COMMAND
| sort - CPU_USAGE
| head 5

View solution in original post

0 Karma

jackpal
Path Finder

Thanks to all who responded.

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Does this do it for you?:

index=os sourcetype=top host=hostname
| stats sum(pctCPU) as CPU_USAGE by USER,COMMAND
| sort - CPU_USAGE
| head 5
0 Karma

renjith_nair
Legend

Hi @jackpal,

Try

index=os sourcetype=top host=hostname |fields USER,pctCPU,COMMAND|sort pctCPU desc|head 5| chart sum(pctCPU) as CPU_USAGE by USER,COMMAND

This will sort based on cpu usage not on the sum . If you need to sort on sum of cpu usage of a user then , try

    index=os sourcetype=top host=hostname |stats sum(pctCPU) as CPU_USAGE by USER,COMMAND
    |sort CPU_USAGE desc|head 5
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 3)

Welcome back to Splunk Classroom Chronicles, our ongoing blog series that pulls back the curtain on Splunk ...

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Almost Too Eventful Assurance: Part 1

Modern IT and Network teams still struggle with too many alerts and isolating issues before they are notified. ...