Dashboards & Visualizations

How to sort total when using eval case to create chart?

jwalzerpitt
Influencer

I have the following search that shows the top 10 hosts by count of vulnerability categories:

index=foo
| stats count as Count by security_group_name, severity 
| chart useother=true first(Count) over security_group_name by severity 
| eval total=case(critical>0 AND high>0,critical+high,critical>0,critical,high>0,high,1==1,0) 
| eval subTotal=case(medium>0 AND low>0,medium+low,medium>0,medium,low>0,low,1==1,0) 
| sort 10 - subTotal,subSubTotal,total 
| fields - subTotal,subSubTotal,total
| table "security_group_name",critical,high,medium,low

This issue with my chart is that the results are not sorted by the overall total so I see the following results:

splunk chart.JPG

How do I modify my search to sort by overall count/total?

Thx

Labels (1)
Tags (4)
0 Karma
1 Solution

johnhuang
Motivator

Add this to the end of your query:

| addtotals | sort - Total | fields - Total

View solution in original post

0 Karma

johnhuang
Motivator

Add this to the end of your query:

| addtotals | sort - Total | fields - Total
0 Karma

jwalzerpitt
Influencer

TYVM as that solved the issue - I was messing around with the | addtotals command but just had it in the wrong place

Thx again!

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...