Splunk Search

Create new field based off of sort order

corematrix
New Member

I've just created a simple search which sorts people's scores (anywhere from 0 to 10000).
I want to be able to show that the person with the highest score is 1 (first). So, in short, i want to create a new score called "rank" which is automatically generated off of their scores.

Tags (1)
0 Karma

woodcock
Esteemed Legend

The other answer does not account for ties, this one does:

index=_*
| stats count BY sourcetype
| sort 0 - count
| streamstats count AS rank
| eventstats max(rank) AS rank BY count

Depending on how you sort, you might have to change max to min.

0 Karma

renjith_nair
Legend

@corematrix,

Use streamstats, for e.g.

index=_*|stats count by sourcetype|sort 0 - count|streamstats count as rank
---
What goes around comes around. If it helps, hit it with Karma 🙂

corematrix
New Member

streamstats count as "rank"

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...