I've just created a simple search which sorts people's scores (anywhere from 0 to 10000).
I want to be able to show that the person with the highest score is 1 (first). So, in short, i want to create a new score called "rank" which is automatically generated off of their scores.
The other answer does not account for ties, this one does:
index=_*
| stats count BY sourcetype
| sort 0 - count
| streamstats count AS rank
| eventstats max(rank) AS rank BY count
Depending on how you sort, you might have to change max
to min
.
@corematrix,
Use streamstats
, for e.g.
index=_*|stats count by sourcetype|sort 0 - count|streamstats count as rank
streamstats count as "rank"