Actually I gave a bad example in my original perl code since that was the text mode report. The HTML mode report has the same perl Hash but loads a HTML table similar to my table example above.
I want to sort by 'cnt' so perhaps I'm better off just loading an array with the row values from the hash and sorting it as I load it. I can sort by RemIP, or PID no problem. I get lost when it comes to 'cnt' since if I sort it at the wrong place im just ordering it within the Type or PID part.
Whereas what I want is to bubble the rows with high CNT values up to the top of the report.
$sock_total{$rip}{$pid}{$type}{'cnt'}