Splunk Search

How to sort by field?

jackpal
Path Finder

I am trying to get the highest used process percentage by user, however, I am unable to sort by the field I want to.

index=os sourcetype=top host=hostname
| chart sum(pctCPU) as CPU_USAGE by USER,COMMAND
| sort sum(pctCPU) desc 
| head 5

This produces a table but I'd like the chart to only show the top 5 users and the commands they are running sorted by their CPU_USAGE

0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust

Does this do it for you?:

index=os sourcetype=top host=hostname
| stats sum(pctCPU) as CPU_USAGE by USER,COMMAND
| sort - CPU_USAGE
| head 5

View solution in original post

0 Karma

jackpal
Path Finder

Thanks to all who responded.

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Does this do it for you?:

index=os sourcetype=top host=hostname
| stats sum(pctCPU) as CPU_USAGE by USER,COMMAND
| sort - CPU_USAGE
| head 5
0 Karma

renjith_nair
Legend

Hi @jackpal,

Try

index=os sourcetype=top host=hostname |fields USER,pctCPU,COMMAND|sort pctCPU desc|head 5| chart sum(pctCPU) as CPU_USAGE by USER,COMMAND

This will sort based on cpu usage not on the sum . If you need to sort on sum of cpu usage of a user then , try

    index=os sourcetype=top host=hostname |stats sum(pctCPU) as CPU_USAGE by USER,COMMAND
    |sort CPU_USAGE desc|head 5
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...