I have a Splunk query that shows a count of error codes by software version. The table looks something like this:
Error Code 1.1 1.2 1.3
Error 1 5 0 10
Error 2 7 9 0
Error 3 20 3 8
What I'd like to do is dynamically find the column with the max value across all columns and sort descending on that column. Is that even possible?
Try this (may be inefficient) workaround
"Your base search giving you output in Above format" | table [search "Your base search giving you output in Above format" | untable "Error Code" SoftwareVersion Count | stats max(Count) as count by SoftwareVersion | sort 0 - count | stats list(SoftwareVersion) as search | nomv search]
I will give this a try, thanks!