https://community.splunk.com/t5/Splunk-Search/How-to-rank-dynamic-scores-with-ties-in-Splunk/m-p/503858#M141008 <P>when i tried same i got ranks but some ranks are missing.</P><P>Ex: i got ranks like below</P><P>score&nbsp; &nbsp; Rank</P><P>100&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1</P><P>100&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1</P><P>125&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 4</P><P>165&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;7</P><P>170&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 8</P><P>&nbsp;</P><P>why it is happening how to solve it?</P> Thu, 11 Jun 2020 06:25:33 GMT shivareddysompa 2020-06-11T06:25:33Z https://community.splunk.com/t5/Splunk-Search/How-to-rank-dynamic-scores-with-ties-in-Splunk/m-p/336895#M141005 <P>I have dynamic number of scores that I wanted to be ranked. For example I have 5 scores - 100, 100, 99, 98, 98. The top rank should be 5 all the way down to 1 but in case of ties, the total rank (of ties) when added should be distributed equally in those scores with tie values. For my set of example above, rank should be: <BR />Score : Rank<BR />100 : 4.5<BR />100 : 4.5<BR />99 : 3<BR />98 : 1.5<BR />98 : 1.5</P> <P>Another example if there are no ties:<BR />Score : Rank<BR />100 : 5<BR />99 : 4<BR />88 : 3<BR />76 : 2<BR />75 : 1</P> <P>Second example is easily achievable via streamstats command however I'm having a hard time when there are tie scores. <BR />Thanks in advance!</P> Wed, 17 Jun 2020 18:31:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-rank-dynamic-scores-with-ties-in-Splunk/m-p/336895#M141005 rolly_deguzman 2020-06-17T18:31:31Z https://community.splunk.com/t5/Splunk-Search/How-to-rank-dynamic-scores-with-ties-in-Splunk/m-p/336896#M141006 <P>Hi rolly_deguzman,<BR /> Try this:</P> <PRE><CODE>your_search | fields score | sort score | eval rank=1 | accum rank | eventstats sum(rank) AS rank count BY score | eval rank=rank/count | sort -rank </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Sat, 28 Oct 2017 16:41:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-rank-dynamic-scores-with-ties-in-Splunk/m-p/336896#M141006 gcusello 2017-10-28T16:41:40Z https://community.splunk.com/t5/Splunk-Search/How-to-rank-dynamic-scores-with-ties-in-Splunk/m-p/336897#M141007 <P>This solution works flawlessly! Thank you very much! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 30 Oct 2017 06:25:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-rank-dynamic-scores-with-ties-in-Splunk/m-p/336897#M141007 rolly_deguzman 2017-10-30T06:25:50Z https://community.splunk.com/t5/Splunk-Search/How-to-rank-dynamic-scores-with-ties-in-Splunk/m-p/503858#M141008 <P>when i tried same i got ranks but some ranks are missing.</P><P>Ex: i got ranks like below</P><P>score&nbsp; &nbsp; Rank</P><P>100&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1</P><P>100&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1</P><P>125&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 4</P><P>165&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;7</P><P>170&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 8</P><P>&nbsp;</P><P>why it is happening how to solve it?</P> Thu, 11 Jun 2020 06:25:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-rank-dynamic-scores-with-ties-in-Splunk/m-p/503858#M141008 shivareddysompa 2020-06-11T06:25:33Z