I need to assign number each event sorted in decending _time order.
Ex
Event. _time Count
Event1. 11:54:51. 1
Event2. 11:53:57 2
Event3. 11:53:52. 3
I can use |streamstats
count.
But does this guarantee events in descending order for historical searches on clustered indexers? Using sorting on _time is effecting query performance. So Is there any way to assign a increment number count based on descending order of _time.
If you don't want to sort, then you can use tail before streamstats.
By default 10 gives 10 event count, if you have an idea about the maximum number of events in that time frame you can use that (eg. tail 100000)
hi @ankithreddy777
can you try before |sort - _time
before streamstats