What is the best way to number each event in descending time?

[ankithreddy777]

I need to assign number each event sorted in decending _time order.

Ex

Event.     _time                  Count
Event1.      11:54:51.           1
Event2.      11:53:57            2
Event3.      11:53:52.           3

I can use |streamstats count.

But does this guarantee events in descending order for historical searches on clustered indexers? Using sorting on _time is effecting query performance. So Is there any way to assign a increment number count based on descending order of _time.

[Vijeta]

If you don't want to sort, then you can use tail before streamstats.
By default 10 gives 10 event count, if you have an idea about the maximum number of events in that time frame you can use that (eg. tail 100000)

[harishalipaka]

hi @ankithreddy777

can you try before |sort - _time before streamstats