ComputerName Events Rank
ABC 320 1
BCD 229 2
CDE 120 3
need to create rank Column based on Event count
Thanks for response and what is the logic if my outcome like below
if my events are same then Rank should be same and based on event number decrease rank has to decrease
the query which I shared is applicable when events are same then rank will also be same. Please try above and confirm.
i executed same but not working
it works like
event count is same but rank differ
did you tried below query with sample data-
|makeresults|eval ComputerName ="abc", Events ="200"
|append[|makeresults|eval ComputerName ="bcd", Events ="100"]
|append[|makeresults|eval ComputerName ="fcd", Events ="200"]
|append[|makeresults|eval ComputerName ="def", Events ="300"]|sort - Events | streamstats current=f window=1 values(Events) as prev | eval Rank=if(prev=Events,0,1) | accum Rank
Here Events has 200 value twice and Rank assigned for these two events is 2 for both.
If still it is not working then please share your query.
@shivareddysompalle,
Try below here I included logic when you have same values-
...|sort - Events | streamstats current=f window=1 values(Events) as prev | eval Rank_filled=if(prev=Events,0,1) | accum Rank_filled
Below search is using sample data
|makeresults|eval ComputerName ="abc", Events ="200"
|append[|makeresults|eval ComputerName ="bcd", Events ="100"]
|append[|makeresults|eval ComputerName ="fcd", Events ="200"]
|append[|makeresults|eval ComputerName ="def", Events ="300"]|sort - Events | streamstats current=f window=1 values(Events) as prev | eval Rank_filled=if(prev=Events,0,1) | accum Rank_filled