topic Re: Ranking Rows in a Table based on the count in Splunk Search

Ranking Rows in a Table based on the count

kabiraj — Wed, 03 Jun 2015 07:12:48 GMT

I have a table containing two columns: Channel Name and Total views. I want to create another column using eval to rank these channels based on the counts of the Total Views.

e.g.

BBC Sport 1     5566     1
BBC Sport 2     3000     2
FOX HD          1134     3

and so on till the channel with least number of views.

First col - Channel Name, Second col - Total Views, Third Col - Rank. Can it be done in Splunk. Please reply.

Re: Ranking Rows in a Table based on the count

davebrooking — Wed, 03 Jun 2015 07:29:18 GMT

You should be able to use the streamstats command to do this.

Re: Ranking Rows in a Table based on the count

stephanefotso — Wed, 03 Jun 2015 07:30:45 GMT

Can you be more specific? Your table has 5 columns. What is the rank and how do you get it?

Re: Ranking Rows in a Table based on the count

kabiraj — Wed, 03 Jun 2015 07:40:10 GMT

Hi davebrooking. I don't want to show statistics for each event. I want to first sum up views count for a single channel using sum command, sort it in descending order and rank it from top to bottom based on the total views count for each channel.

Re: Ranking Rows in a Table based on the count

sc0tt — Wed, 03 Jun 2015 07:44:20 GMT

As @davebrooking mentioned, streamstats should be able to do this your search | sort -field | streamstats count

Re: Ranking Rows in a Table based on the count

kabiraj — Wed, 03 Jun 2015 07:49:52 GMT

Thanks davebrooking & sc0tt.