Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

display results in descending order

$
0
0
It shows the result in the below format uri 208 400 ... .... ... I want to show those uri's on top which has maximum responseCodes, I tried using the below query but it is not giving the desired output. host="*prod*" uri="*v*" earliest = -7d@d | WHERE responseCode != 200 | chart count by uri, responseCode | sort -responseCode sort is not giving results in descending order.

Viewing all articles
Browse latest Browse all 47296

Trending Articles