Splunk Search

show table results in descending count order

bcusick
Communicator

Hi,

I'm thinking this has a simple solution..Is there anyway to show a table in descending order by count? Currently it always goes alphabetically.

Now:

Anthony        6
Brian          8
Michael        4

I would like to see:

Brian          8
Anthony        6
Michael        4

The way I'm currently outputting this is ` | stats count by login_name, year_day | stats count AS "Number of days Logged in" by login_name

Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Maybe ' ... | sort - "Number of days Logged in"' ?

---
If this reply helps you, Karma would be appreciated.

View solution in original post

vasanthmss
Motivator

use the below one,

| sort 0 - "Number of days Logged in"

while using sort you can mention the limitation, zero means there will not be any limits applied. 😉

V

richgalloway
SplunkTrust
SplunkTrust

Maybe ' ... | sort - "Number of days Logged in"' ?

---
If this reply helps you, Karma would be appreciated.

w531t4
Path Finder

I downvoted this post because does not work on datasets larger than 10000 rows

0 Karma

helge
Builder

Add limit=0 to remove the limitation to 10,000 rows

0 Karma

bcusick
Communicator

BeautifuL! Thank you.

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...