Hi at all I have to show the subtotal of a stats command, but the problem is to sort the results:
my search is tag=GP2 | stats count by code day | appendpipe [stats sum(count) AS Totals by code ] | sort code -count
using this search I can sort only by code, instead I have to sort by totals as shown below.
Code day count totals
Code1 2015-01-16 20
Code1 2015-01-15 15
Code1 35
Code2 2015-01-15 12
Code2 2015-01-16 10
Code2 22
in other words I want to group results by Code, to sort by Total and in every code to sort by count.
I found the way to sort only by Code, is it possible to do this?
thank you.
Giuseppe
↧