topic Re: What is the best way to number each event in descending time? in Splunk Search

What is the best way to number each event in descending time?

ankithreddy777 — Fri, 28 Sep 2018 11:00:12 GMT

I need to assign number each event sorted in decending _time order.

Event.     _time                  Count
Event1.      11:54:51.           1
Event2.      11:53:57            2
Event3.      11:53:52.           3

I can use |streamstats count.

But does this guarantee events in descending order for historical searches on clustered indexers? Using sorting on _time is effecting query performance. So Is there any way to assign a increment number count based on descending order of _time.

Re: What is the best way to number each event in descending time?

harishalipaka — Fri, 28 Sep 2018 11:19:52 GMT

hi @ankithreddy777

can you try before |sort - _time before streamstats

Re: What is the best way to number each event in descending time?

Vijeta — Fri, 28 Sep 2018 16:19:21 GMT

If you don't want to sort, then you can use tail before streamstats.
By default 10 gives 10 event count, if you have an idea about the maximum number of events in that time frame you can use that (eg. tail 100000)