How to rank dynamic scores with ties in Splunk?

[rolly_deguzman]

I have dynamic number of scores that I wanted to be ranked. For example I have 5 scores - 100, 100, 99, 98, 98. The top rank should be 5 all the way down to 1 but in case of ties, the total rank (of ties) when added should be distributed equally in those scores with tie values. For my set of example above, rank should be:
Score : Rank
100 : 4.5
100 : 4.5
99 : 3
98 : 1.5
98 : 1.5

Another example if there are no ties:
Score : Rank
100 : 5
99 : 4
88 : 3
76 : 2
75 : 1

Second example is easily achievable via streamstats command however I'm having a hard time when there are tie scores.
Thanks in advance!

[gcusello · Accepted solution]

Hi rolly_deguzman,
Try this:

your_search
| fields score 
| sort score 
| eval rank=1 
| accum rank 
| eventstats sum(rank) AS rank count BY score 
| eval rank=rank/count
| sort -rank

Bye.
Giuseppe

[shivareddysompa]

when i tried same i got ranks but some ranks are missing.

Ex: i got ranks like below

score    Rank

100         1

100          1

125          4

165           7

170          8

why it is happening how to solve it?

[rolly_deguzman]

This solution works flawlessly! Thank you very much! 🙂