Splunk Search

How to sort search results by numbers

tobi2k
Explorer

The rounding of search results has already been discussed numerously. But unfortunately, it doesn't work for me.
I want to sort the result by total_time in descending order:

index="main" sourcetype="web_ping" response_code="200" | stats latest(total_time) by title | sort -num(total_time)

But the result is still sorted by the title.

title   latest(total_time)
brxxx   34.03
bsxxx   86.04
efxxx   157.03
gxxx    265.71
loxxx   340.82
stexxx  179.74
thxxx   239.87
winxxxe 292.73

Do you have a hint? Thank you!

0 Karma

tobi2k
Explorer

Works like a charm! Thank you!

0 Karma

tobi2k
Explorer

Thanks for your answer. I don't get it.

index="main" sourcetype="web_ping" response_code="200" | stats latest(total_time) by title | sort -latest

still deliver the result in the wrong order (highest number first)

    title   latest(total_time)
    bxxx    30.01
    bxxx    84.33
    efxxx   144.48
    gxxx    251.93
    loxxx   263.72
    etc...
0 Karma

HiroshiSatoh
Champion

Please look at my answer.

0 Karma

HiroshiSatoh
Champion

total_time does not exist. It is now latest (total_time).

| stats latest(total_time) by title | sort -latest(total_time)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...