Splunk Search

How to sort by max value of a dynamic set of columns

dbendixen
Explorer

I have a Splunk query that shows a count of error codes by software version. The table looks something like this:

Error Code      1.1     1.2     1.3
Error 1         5       0       10
Error 2         7       9       0
Error 3         20      3       8

What I'd like to do is dynamically find the column with the max value across all columns and sort descending on that column. Is that even possible?

Tags (4)
0 Karma

somesoni2
Revered Legend

Try this (may be inefficient) workaround

"Your  base search giving you output in Above format" | table [search "Your  base search giving you output in Above format" | untable "Error Code" SoftwareVersion Count | stats max(Count) as count by SoftwareVersion | sort 0 - count | stats list(SoftwareVersion) as search | nomv search] 

dbendixen
Explorer

I will give this a try, thanks!

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...