Answer by warren for How to display the total count in a page and overall total count for a column in splunk dashboard

Sounds like you want to sort your data to put the totals row on top (though, of course, it might move if you sort by clicking afterwards):

<search>
| addcoltotals
| sort 0 - someFieldThatHasBeenTotaled

Always use | sort 0 so that if you have more than 10k rows, Splunk doesn’t truncate the resultset at 10k rows

from User warren – Stack Overflow https://stackoverflow.com/questions/75936627/how-to-display-the-total-count-in-a-page-and-overall-total-count-for-a-column-in/75939050#75939050
via IFTTT