Dashboards & Visualizations

How to sort total when using eval case to create chart?

jwalzerpitt
Influencer

I have the following search that shows the top 10 hosts by count of vulnerability categories:

index=foo
| stats count as Count by security_group_name, severity 
| chart useother=true first(Count) over security_group_name by severity 
| eval total=case(critical>0 AND high>0,critical+high,critical>0,critical,high>0,high,1==1,0) 
| eval subTotal=case(medium>0 AND low>0,medium+low,medium>0,medium,low>0,low,1==1,0) 
| sort 10 - subTotal,subSubTotal,total 
| fields - subTotal,subSubTotal,total
| table "security_group_name",critical,high,medium,low

This issue with my chart is that the results are not sorted by the overall total so I see the following results:

splunk chart.JPG

How do I modify my search to sort by overall count/total?

Thx

Labels (1)
Tags (4)
0 Karma
1 Solution

johnhuang
Motivator

Add this to the end of your query:

| addtotals | sort - Total | fields - Total

View solution in original post

0 Karma

johnhuang
Motivator

Add this to the end of your query:

| addtotals | sort - Total | fields - Total
0 Karma

jwalzerpitt
Influencer

TYVM as that solved the issue - I was messing around with the | addtotals command but just had it in the wrong place

Thx again!

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...