Leaderboard report

[ianmaddox4bookr]

I'd like to build a leaderboard style report. I want to show the top 100 items in a list and have a column that shows the delta compared to this same time last week. Is there a plugin or some other report that makes this possible?

[martin_mueller · Accepted solution]

You could do this:

index=_internal earliest=-1w@d latest=@d | top source | join source [search index=_internal earliest=-2w@d latest=-1w@d | top source | rename count as previous_count percent as previous_percent] | eval delta = count - previous_count

Modify to fit your data and desired output.

[ianmaddox4bookr]

Thanks! That was definitely the right approach. I massaged it a bit to give a delta of rankings:

sourcetype=search earliest=-1d@d latest=@d | top search_query limit=100 | eval rank = 1 | accum rank | join search_query [search sourcetype=search earliest=-2d@d latest=-1d@d | top search_query limit=500 | eval prev_rank = 1 | accum prev_rank | rename count as prev_count percent as prev_percent] | eval delta = "+" . (prev_rank - rank) | replace "+-" with "-" in delta | replace "+0" with "--" in delta | table delta search_query count percent