I have a table containing two columns: Channel Name and Total views. I want to create another column using eval to rank these channels based on the counts of the Total Views.
e.g.
BBC Sport 1 5566 1
BBC Sport 2 3000 2
FOX HD 1134 3
and so on till the channel with least number of views.
First col - Channel Name, Second col - Total Views, Third Col - Rank. Can it be done in Splunk. Please reply.
Can you be more specific? Your table has 5 columns. What is the rank and how do you get it?
Thanks davebrooking & sc0tt.
Hi davebrooking. I don't want to show statistics for each event. I want to first sum up views count for a single channel using sum command, sort it in descending order and rank it from top to bottom based on the total views count for each channel.
As @davebrooking mentioned, streamstats should be able to do this your search | sort -field | streamstats count