i need to create Rank based on Events that will occur dynamically. i've tried this but not able to do
index="abc" source="bcd" |eval ComputerName=upper(ComputerName) |join ComputerName [|savedsearch Computers_By_Product productName="DELL"] | eval title = replace(title,"{","") | eval title = replace(title,"}","") | rename title as signature | join type=left signature [search index="abc" source="dce" earliest=1 latest=now() | stats dc(id) as IDs by signature] | eventstats dc(DateTime) as issueCount by ComputerName | eventstats dc(ID) as fixCount by ComputerName |sort 0 - issueCount |streamstats current=f window=1 values(issueCount) as Prev|eval Rank_filled=if(prev=issueCount,0,1) | accum Rank_filled|table ComputerName issueCount Rank_filled
i need rank like
issueCount Rank
2 1
2 1
1 2
1 2
thanks