need to create separate field which will show rank based on event Count

[shivareddysompa]

ComputerName Events Rank

    ABC     100        1
    BCD 200        2
    CDE     300        3

i need to create Rank by Events

[shivareddysompa]

my intention is highest number of event has to hold 1 rank then following and if events are same then rank should be same

[shivareddysompa]

anyone is there to help on above request?

[493669]

@shivareddysompalle,
Use first sort then streamstats command to calculate rank-

...|sort Events| streamstats count AS Rank

Below is using sample data-

|makeresults|eval ComputerName ="abc", Events ="200"
|append[|makeresults|eval ComputerName ="bcd", Events ="100"]
|append[|makeresults|eval ComputerName ="def", Events ="300"]|sort Events| streamstats count AS Rank

[493669]

@shivareddysompalle,
Try below-

|makeresults|eval ComputerName ="abc", Events ="200"
  |append[|makeresults|eval ComputerName ="bcd", Events ="100"]
   |append[|makeresults|eval ComputerName ="fcd", Events ="200"]
  |append[|makeresults|eval ComputerName ="def", Events ="300"]|sort - Events | streamstats current=f window=1 values(Events) as prev | eval Rank_filled=if(prev=Events,0,1) | accum Rank_filled

[shivareddysompa]

used same but not worked .
i can't share my query since it is organisational data .

[493669]

Can you share some sample data and your query by masking confidential data.
since as per your data from question it should work.

[shivareddysompa]

    COmputerName  Countofissues
    ABC     10
    BCD     22
    DCE     32  

my query is like
eventstats dc(Computername) as Countofissues by Computername

i need to assign rank based on Countofisues . Countofissues will change dynamically by time

[493669]

Try below without using above eventstats command-

...|table ComputerName Countofissues|sort - Countofissues | streamstats current=f window=1 values(Countofissues) as prev | eval Rank=if(prev=Countofissues,0,1) | accum Rank|table ComputerName Countofissues Rank

[shivareddysompa]

how i will get Count of issues without eventstats ?
if i use stats no issues are found

[493669]

use-

stats count as Countofissues by ComputerName

[shivareddysompa]

even i have applied rank is same like 1 2 3

[shivareddysompa]

my query is below:

index="abc" source="bcd"
|eval ComputerName=upper(ComputerName)
|join ComputerName
[|savedsearch Computers_By_Product productName="DELL"]
| eval title = replace(title,"{","")
| eval title = replace(title,"}","")
| rename title as signature
| join type=left signature
[search index="abc" source="dce" earliest=1 latest=now() | stats dc(id) as IDs by signature]
| eventstats dc(DateTime) as issueCount by ComputerName
| eventstats dc(ID) as fixCount by ComputerName
|sort issueCount |streamstats current=f window=1 values(issueCount) as Prev|eval Rank_filled=if(prev=Events,0,1) | accum Rank_filled|table ComputerName issueCount Rank_filled

[493669]

Try below-

index="abc" source="bcd"
|eval ComputerName=upper(ComputerName)
|join ComputerName
[|savedsearch Computers_By_Product productName="DELL"]
| eval title = replace(title,"{","")
| eval title = replace(title,"}","")
| rename title as signature
| join type=left signature
[search index="abc" source="dce" earliest=1 latest=now() | stats dc(id) as IDs by signature]
| eventstats dc(DateTime) as issueCount by ComputerName
| eventstats dc(ID) as fixCount by ComputerName
|sort 0 - issueCount |streamstats current=f window=1 values(issueCount) as Prev|eval Rank_filled=if(prev=issueCount,0,1) | accum Rank_filled|table ComputerName issueCount Rank_filled

[shivareddysompa]

got results like

issueCount Rank
2 1
2 2
1 3
1 4

need the rank like
issueCount Rank
2 1
2 1
1 2
1 2

[shivareddysompa]

@woodcock

please help on this