Splunk Search

How to sort group by results?

ramki1459
Explorer

For example:

raw data is

100,x,info=1,error=1,warn=1
101,x,info=1,error=1,warn=1
101,y,info=1,error=2,warn=1
101,y,info=1,error=3,warn=1

| query
| chart count by x y 
| addtotals col=true labelfield=x label="Totals"

Sample results

event, info, error, warn  Total
 x         2        2         2       6
 y         2        5         2       9
Totals 4        7         4       15 

In the above query I want to sort the data based on group by query results in desc order. when i try | sort 0 -Totals, Totals column appearing first row in table.

| query
| chart count by x y 
| addtotals col=true labelfield=x label="Totals"
| sort 0 -Total

Result:

event, info, error, warn  Total
Totals 4        7         4       15
 y         2        5         2       9
 x         2        2         2       6

But I want to display results as

event, info, error, warn  Total
 y         2        5         2       9
 x         2        2         2       6
Totals 4        7         4       15

Any inputs here really helps me. Thanks

Tags (2)
0 Karma
1 Solution

ramki1459
Explorer

i am able resolve my problem modifying query this
`| query
| chart count by x y
| sort 0 info desc
| addtotals col=true labelfield=x label="Totals"

View solution in original post

0 Karma

ramki1459
Explorer

i am able resolve my problem modifying query this
`| query
| chart count by x y
| sort 0 info desc
| addtotals col=true labelfield=x label="Totals"

0 Karma

niketn
Legend

@ramki1459, I have converted your comment to answer. Please accept the same to mark this question as answered!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...