Splunk Search

How to sort group by results?

ramki1459
Explorer

For example:

raw data is

100,x,info=1,error=1,warn=1
101,x,info=1,error=1,warn=1
101,y,info=1,error=2,warn=1
101,y,info=1,error=3,warn=1

| query
| chart count by x y 
| addtotals col=true labelfield=x label="Totals"

Sample results

event, info, error, warn  Total
 x         2        2         2       6
 y         2        5         2       9
Totals 4        7         4       15 

In the above query I want to sort the data based on group by query results in desc order. when i try | sort 0 -Totals, Totals column appearing first row in table.

| query
| chart count by x y 
| addtotals col=true labelfield=x label="Totals"
| sort 0 -Total

Result:

event, info, error, warn  Total
Totals 4        7         4       15
 y         2        5         2       9
 x         2        2         2       6

But I want to display results as

event, info, error, warn  Total
 y         2        5         2       9
 x         2        2         2       6
Totals 4        7         4       15

Any inputs here really helps me. Thanks

Tags (2)
0 Karma
1 Solution

ramki1459
Explorer

i am able resolve my problem modifying query this
`| query
| chart count by x y
| sort 0 info desc
| addtotals col=true labelfield=x label="Totals"

View solution in original post

0 Karma

ramki1459
Explorer

i am able resolve my problem modifying query this
`| query
| chart count by x y
| sort 0 info desc
| addtotals col=true labelfield=x label="Totals"

0 Karma

niketn
Legend

@ramki1459, I have converted your comment to answer. Please accept the same to mark this question as answered!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...