Splunk Search

Ranking Rows in a Table based on the count

Path Finder

I have a table containing two columns: Channel Name and Total views. I want to create another column using eval to rank these channels based on the counts of the Total Views.

e.g.

BBC Sport 1     5566     1
BBC Sport 2     3000     2
FOX HD          1134     3

and so on till the channel with least number of views.

First col - Channel Name, Second col - Total Views, Third Col - Rank. Can it be done in Splunk. Please reply.

Tags (4)
0 Karma
1 Solution

Contributor

You should be able to use the streamstats command to do this.

View solution in original post

Motivator

Can you be more specific? Your table has 5 columns. What is the rank and how do you get it?

0 Karma

Contributor

You should be able to use the streamstats command to do this.

View solution in original post

Path Finder

Thanks davebrooking & sc0tt.

0 Karma

Path Finder

Hi davebrooking. I don't want to show statistics for each event. I want to first sum up views count for a single channel using sum command, sort it in descending order and rank it from top to bottom based on the total views count for each channel.

0 Karma

Builder

As @davebrooking mentioned, streamstats should be able to do this your search | sort -field | streamstats count