new column Rank Based on events

[shivareddysompa]

ComputerName Events Rank

    ABC     320 1
    BCD 229 2
    CDE     120 3

need to create rank Column based on Event count

[shivareddysompa]

Thanks for response and what is the logic if my outcome like below

if my events are same then Rank should be same and based on event number decrease rank has to decrease

[493669]

the query which I shared is applicable when events are same then rank will also be same. Please try above and confirm.

[shivareddysompa]

i executed same but not working

it works like
event count is same but rank differ

[493669]

did you tried below query with sample data-

|makeresults|eval ComputerName ="abc", Events ="200"
  |append[|makeresults|eval ComputerName ="bcd", Events ="100"]
   |append[|makeresults|eval ComputerName ="fcd", Events ="200"]
  |append[|makeresults|eval ComputerName ="def", Events ="300"]|sort - Events | streamstats current=f window=1 values(Events) as prev | eval Rank=if(prev=Events,0,1) | accum Rank

Here Events has 200 value twice and Rank assigned for these two events is 2 for both.
If still it is not working then please share your query.

[493669]

@shivareddysompalle,
Try below here I included logic when you have same values-

...|sort - Events | streamstats current=f window=1 values(Events) as prev | eval Rank_filled=if(prev=Events,0,1) | accum Rank_filled

Below search is using sample data

|makeresults|eval ComputerName ="abc", Events ="200"
 |append[|makeresults|eval ComputerName ="bcd", Events ="100"]
  |append[|makeresults|eval ComputerName ="fcd", Events ="200"]
 |append[|makeresults|eval ComputerName ="def", Events ="300"]|sort - Events | streamstats current=f window=1 values(Events) as prev | eval Rank_filled=if(prev=Events,0,1) | accum Rank_filled