Splunk Enterprise

Dynamic rank need to cretae based on events

shivareddysompa
Explorer

i need to create Rank based on Events that will occur dynamically. i've tried this but not able to do

index="abc" source="bcd"
|eval ComputerName=upper(ComputerName)
|join ComputerName
[|savedsearch Computers_By_Product productName="DELL"]
| eval title = replace(title,"{","")
| eval title = replace(title,"}","")
| rename title as signature
| join type=left signature
[search index="abc" source="dce" earliest=1 latest=now() | stats dc(id) as IDs by signature]
| eventstats dc(DateTime) as issueCount by ComputerName
| eventstats dc(ID) as fixCount by ComputerName
|sort 0 - issueCount |streamstats current=f window=1 values(issueCount) as Prev|eval Rank_filled=if(prev=issueCount,0,1) | accum Rank_filled|table ComputerName issueCount Rank_filled

i need rank like 

issueCount Rank
2 1
2 1
1 2
1 2

thanks

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...