I used the following query where I used '-' just beside "Total bytes" without space. As per my understanding, if we have multiple fields after sort and when use '-' just next to the field that field will be sorted descending and the other fields are sorted in ascending order. But I am not getting desired results. Kindly correct me if I am wrong.
index="main" host="web_application" status=200
| stats sum(bytes) as "Total bytes" by file
| sort -"Total bytes" file
it's correct: in your search you sorted at first descending by "Total bytes" (the first field with -) and then all the equal values of "Total bytes" are sorted ascending by file, so it's correct the order you have.