Tables, Charts, and Fields - Implementing Splunk: Big Data Reporting and Development for Operational Intelligence - page 52

It will produce a table like that shown in the following screenshot:

There are a few things to notice about these results:

1. The results are sorted against the values of the "by" fields, in this case logger

followed by user . Unlike top , the largest value will not necessarily be at the
top of the list. You can sort in the GUI simply by clicking on the field names
at the top of the table, or by using the sort command.

2. There is no limit to the number of rows produced. The number of rows will

equal the possible combinations of field values.

3. The function results are displayed last. In the next example, we will add a

few more functions, and this will become more obvious.