Advanced Search Examples - Implementing Splunk: Big Data Reporting and Development for Operational Intelligence - page 132

This gives us (only the first 10 rows are shown):
Next, using accum , we will increment the value of rownum :
sourcetype="impl_splunk_gen" error
| stats count by logger user
| eventstats sum(count) as totalcount
| eval percent=count/totalcount*100
| sort -count
| eval rownum=1
| accum rownum
This gives us (only the first 10 rows are shown):