Splunk Search

Create new field based off of sort order

corematrix
New Member

I've just created a simple search which sorts people's scores (anywhere from 0 to 10000).
I want to be able to show that the person with the highest score is 1 (first). So, in short, i want to create a new score called "rank" which is automatically generated off of their scores.

Tags (1)
0 Karma

woodcock
Esteemed Legend

The other answer does not account for ties, this one does:

index=_*
| stats count BY sourcetype
| sort 0 - count
| streamstats count AS rank
| eventstats max(rank) AS rank BY count

Depending on how you sort, you might have to change max to min.

0 Karma

renjith_nair
Legend

@corematrix,

Use streamstats, for e.g.

index=_*|stats count by sourcetype|sort 0 - count|streamstats count as rank
Happy Splunking!

corematrix
New Member

streamstats count as "rank"

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...