Sorting Question for joins

[jgillman]

I have been trying to sort this and I can not seem to be able to get it.

index=uberagent* sourcetype=uberAgent:System:MachineInventory host=*
| join type=inner host 
   [
      | pivot `uA_DM_System_NetworkConfigInformation` System_NetworkConfigInformation
            values(NetworkConfigIPv4) as "IPv4 address(es)"
             values(SiteName) as SiteName
             splitrow
             _time
             period day
            splitrow
            host
      | fields + host "IPv4 address(es)" City _time SiteName
   ]
| dedup host 
| chart count(HwManufacturer) as total by SiteName HwManufacturer
| sort limit=10 - total

Not sure what I am doing wrong,

[woodcock]

It should work if you use | sort 10 -total but if for some reason it does not, you can use | sort 0 -total | head 10.

[to4kawa]

Hi, I have some questions.

1 Are the results of this subsearch correct?

[
       | pivot \`uA_DM_System_NetworkConfigInformation` System_NetworkConfigInformation
             values(NetworkConfigIPv4) as "IPv4 address(es)"
              values(SiteName) as SiteName
              splitrow
              _time
              period day
             splitrow
             host
       | fields + host "IPv4 address(es)" City _time SiteName
    ]

expected result example:

host "IPv4 address(es)" City _time SiteName
host1 10.10.10.10 City1 20191025 12:00:00 Site1
...etc

2 Is there HwManufacturer in this result?

index=uberagent* sourcetype=uberAgent:System:MachineInventory host=*

3 What are the expected results of this query?

| chart count(HwManufacturer) as total by SiteName HwManufacturer

expected result example:

SiteName HwManufacturer1 HwManufacturer2 .....
Site1 10 20 ....
Site2 30 40 ....

is that right?

regards.

[aberkow]

If you try it without the limit, i.e. | sort 10 - total, does that work? Taking a quick peek at the docs I don't see any references to the limit parameter https://docs.splunk.com/Documentation/SplunkCloud/7.2.7/SearchReference/Sort#Description

[jgillman]

I tried that and the sort still doesn't work. If I get rid of the limit= it still does only give me 10 but not sorted by the total

[aberkow]

I wonder if you can't use sort with chart. If you change chart to stats, does it work then? I don't know if you need chart for some reason, but you're not using the OVER parameter so I'm guessing not.