How to sort the results of a timechart top 5 clients list by client percentage?

[tmurray3]

I have the following query to generate a list of the top 5 clients by volume percentage:

index=volume_hourly_summary report="keyvolumebyhour" | timechart span=1w sum(count) by clientkey limit=5| untable _time clientkey count|eventstats sum(count) as Total by _time|eval clientpercent=round(count*100/Total,2)| table _time,clientkey clientpercent| xyseries _time clientkey clientpercent

I have tried to get the results to be sorted by client percentage, but the output is always sorted by clientkey.

Any ideas?

Thanks in advance for your help!!

[dounla2carlos]

there is problem in your request
sum(count) the field count doesnt exist so you wont get any interesting result
If the output is always sorted by clientkey, its because of this: "timechart span=1w sum(count) by clientkey limit=5"
To have them sorted by Clientpercent you need have a count by Clientpercent n your request

[gyslainlatsa]

Hi tmurray3 ,
try use the sort command as below

index=volume_hourly_summary report="keyvolumebyhour" | timechart span=1w sum(count) by clientkey limit=5| untable _time clientkey count|eventstats sum(count) as Total by _time|eval clientpercent=round(count*100/Total,2)| table _time,clientkey clientpercent| xyseries _time clientkey clientpercent |sort -Clientpercent

sort -Clientpercent to sort in descending order

[somesoni2]

With current query you're getting top 5 clientkey for every week and the clientkey may be different in every week. How many columns you get in the final result?