Splunk Search

show table results in descending count order

bcusick
Communicator

Hi,

I'm thinking this has a simple solution..Is there anyway to show a table in descending order by count? Currently it always goes alphabetically.

Now:

Anthony        6
Brian          8
Michael        4

I would like to see:

Brian          8
Anthony        6
Michael        4

The way I'm currently outputting this is ` | stats count by login_name, year_day | stats count AS "Number of days Logged in" by login_name

Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Maybe ' ... | sort - "Number of days Logged in"' ?

---
If this reply helps you, Karma would be appreciated.

View solution in original post

vasanthmss
Motivator

use the below one,

| sort 0 - "Number of days Logged in"

while using sort you can mention the limitation, zero means there will not be any limits applied. 😉

V

richgalloway
SplunkTrust
SplunkTrust

Maybe ' ... | sort - "Number of days Logged in"' ?

---
If this reply helps you, Karma would be appreciated.

w531t4
Path Finder

I downvoted this post because does not work on datasets larger than 10000 rows

0 Karma

helge
Builder

Add limit=0 to remove the limitation to 10,000 rows

0 Karma

bcusick
Communicator

BeautifuL! Thank you.

0 Karma
Get Updates on the Splunk Community!

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...