Splunk Search

Create new field based off of sort order

corematrix
New Member

I've just created a simple search which sorts people's scores (anywhere from 0 to 10000).
I want to be able to show that the person with the highest score is 1 (first). So, in short, i want to create a new score called "rank" which is automatically generated off of their scores.

Tags (1)
0 Karma

woodcock
Esteemed Legend

The other answer does not account for ties, this one does:

index=_*
| stats count BY sourcetype
| sort 0 - count
| streamstats count AS rank
| eventstats max(rank) AS rank BY count

Depending on how you sort, you might have to change max to min.

0 Karma

renjith_nair
Legend

@corematrix,

Use streamstats, for e.g.

index=_*|stats count by sourcetype|sort 0 - count|streamstats count as rank
---
What goes around comes around. If it helps, hit it with Karma 🙂

corematrix
New Member

streamstats count as "rank"

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...