Splunk Search

How to sort group by results?

ramki1459
Explorer

For example:

raw data is

100,x,info=1,error=1,warn=1
101,x,info=1,error=1,warn=1
101,y,info=1,error=2,warn=1
101,y,info=1,error=3,warn=1

| query
| chart count by x y 
| addtotals col=true labelfield=x label="Totals"

Sample results

event, info, error, warn  Total
 x         2        2         2       6
 y         2        5         2       9
Totals 4        7         4       15 

In the above query I want to sort the data based on group by query results in desc order. when i try | sort 0 -Totals, Totals column appearing first row in table.

| query
| chart count by x y 
| addtotals col=true labelfield=x label="Totals"
| sort 0 -Total

Result:

event, info, error, warn  Total
Totals 4        7         4       15
 y         2        5         2       9
 x         2        2         2       6

But I want to display results as

event, info, error, warn  Total
 y         2        5         2       9
 x         2        2         2       6
Totals 4        7         4       15

Any inputs here really helps me. Thanks

Tags (2)
0 Karma
1 Solution

ramki1459
Explorer

i am able resolve my problem modifying query this
`| query
| chart count by x y
| sort 0 info desc
| addtotals col=true labelfield=x label="Totals"

View solution in original post

0 Karma

ramki1459
Explorer

i am able resolve my problem modifying query this
`| query
| chart count by x y
| sort 0 info desc
| addtotals col=true labelfield=x label="Totals"

0 Karma

niketn
Legend

@ramki1459, I have converted your comment to answer. Please accept the same to mark this question as answered!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...