It shows the result in the below format
uri 208 400
... .... ...
I want to show those uri's on top which has maximum responseCodes, I tried using the below query but it is not giving the desired output.
host="*prod*" uri="*v*" earliest = -7d@d
| WHERE responseCode != 200
| chart count by uri, responseCode
| sort -responseCode
sort is not giving results in descending order.
↧