Ranking Rows in a Table based on the count

[kabiraj]

I have a table containing two columns: Channel Name and Total views. I want to create another column using eval to rank these channels based on the counts of the Total Views.

e.g.

BBC Sport 1     5566     1
BBC Sport 2     3000     2
FOX HD          1134     3

and so on till the channel with least number of views.

First col - Channel Name, Second col - Total Views, Third Col - Rank. Can it be done in Splunk. Please reply.

[stephanefotso]

Can you be more specific? Your table has 5 columns. What is the rank and how do you get it?

[davebrooking · Accepted solution]

You should be able to use the streamstats command to do this.

[kabiraj]

Thanks davebrooking & sc0tt.

[kabiraj]

Hi davebrooking. I don't want to show statistics for each event. I want to first sum up views count for a single channel using sum command, sort it in descending order and rank it from top to bottom based on the total views count for each channel.

[sc0tt]

As @davebrooking mentioned, streamstats should be able to do this your search | sort -field | streamstats count