Splunk Search

How to sort group by results?

ramki1459
Explorer

For example:

raw data is

100,x,info=1,error=1,warn=1
101,x,info=1,error=1,warn=1
101,y,info=1,error=2,warn=1
101,y,info=1,error=3,warn=1

| query
| chart count by x y 
| addtotals col=true labelfield=x label="Totals"

Sample results

event, info, error, warn  Total
 x         2        2         2       6
 y         2        5         2       9
Totals 4        7         4       15 

In the above query I want to sort the data based on group by query results in desc order. when i try | sort 0 -Totals, Totals column appearing first row in table.

| query
| chart count by x y 
| addtotals col=true labelfield=x label="Totals"
| sort 0 -Total

Result:

event, info, error, warn  Total
Totals 4        7         4       15
 y         2        5         2       9
 x         2        2         2       6

But I want to display results as

event, info, error, warn  Total
 y         2        5         2       9
 x         2        2         2       6
Totals 4        7         4       15

Any inputs here really helps me. Thanks

Tags (2)
0 Karma
1 Solution

ramki1459
Explorer

i am able resolve my problem modifying query this
`| query
| chart count by x y
| sort 0 info desc
| addtotals col=true labelfield=x label="Totals"

View solution in original post

0 Karma

ramki1459
Explorer

i am able resolve my problem modifying query this
`| query
| chart count by x y
| sort 0 info desc
| addtotals col=true labelfield=x label="Totals"

0 Karma

niketn
Legend

@ramki1459, I have converted your comment to answer. Please accept the same to mark this question as answered!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...