topic Re: How to change count value? in Splunk Cloud Platform

How to change count value?

Cat26 — Thu, 11 May 2023 13:46:02 GMT

For the below table, 26th row, count should be 8 because there is different Mac_ID inbetween.

| streamstats count(eval(Mac_ID=="Serial num")) as Inspection_Count

Query which I have written is, if serial number followed by mac_id then count should be calculated. But here in 26th row, there is no serial number so the count is continuing. How can I change if mac_Id changes inbetween when there is no serial number.

Sno	_time	Device_ID	Mac_ID	Inspection_Count
1	2018-05-31T03:24:57.182+05:30	10	Started	1
2	2018-05-31T03:24:57.182+05:30	10	Serialnum	1
3	2018-05-31T03:24:58.869+05:30	10	5102	1
4	2018-05-31T03:25:09.179+05:30	10	5102	1
5	2018-05-31T06:23:23.446+05:30	10	Started	2
6	2018-05-31T06:23:23.446+05:30	10	Serialnum	2
7	2018-05-31T06:23:24.608+05:30	10	5102	2
8	2018-05-31T06:40:46.619+05:30	10	Started	3
9	2018-05-31T06:40:46.619+05:30	10	Serialnum	3
10	2018-05-31T06:46:59.594+05:30	10	5102	3
11	2018-05-31T06:47:00.084+05:30	10	5102	3
12	2018-05-31T06:47:03.098+05:30	10	5102	3
13	2018-05-31T06:58:30.714+05:30	10	Started	4
14	2018-05-31T06:58:30.714+05:30	10	Serialnum	4
15	2018-05-31T07:21:47.990+05:30	10	Started	5
16	2018-05-31T07:21:47.990+05:30	10	Serialnum	5
17	2018-05-31T07:22:09.677+05:30	10	5102	5
18	2018-05-31T07:22:10.063+05:30	10	5102	5
19	2018-05-31T07:22:11.070+05:30	10	5102	5
20	2018-09-05T10:30:13.455+05:30	86	Started	6
21	2018-09-05T10:30:13.455+05:30	86	Serialnum	6
22	2018-09-05T11:08:18.761+05:30	86	Started	7
23	2018-09-05T11:08:18.761+05:30	86	Serialnum	7
24	2018-09-05T11:08:41.907+05:30	86	7878	7
25	2018-09-05T11:08:42.071+05:30	86	7878	7
26	2018-09-05T11:09:04.068+05:30	86	8765	7
27	2018-09-05T11:09:26.877+05:30	86	8765	7
28	2018-09-05T11:09:41.845+05:30	86	8765	7

Re: How to change count value?

richgalloway — Thu, 11 May 2023 18:45:45 GMT

The description does not match the SPL which doesn't match the output.

The SPL increments Inspection_Count each time the Mac_ID field contains the value "Serial num" [sic]. That means the Inspection_Count column should start at zero and increase by one at rows 2, 6, 9, 14, 16, 21, and 23. I see nothing special about row 26.

Re: How to change count value?

Cat26 — Thu, 11 May 2023 21:06:34 GMT

I am not sure why Inspectioncount starts at1 instead if 0.

Now if you see 26th row, Mac_Id changes from 7878 to 8765 and there is no "Serialnum" row between 7878 to 8765. Here if no "Serialnum" row there and macid changes, inspectioncount also should change.

So expected inspection count is 8 here.

Can you please help me to modify the above query

Re: How to change count value?

richgalloway — Fri, 12 May 2023 12:09:22 GMT

I'm sorry, but I can't help with this question as it is currently written. There are too many inconsistencies in the sample output so I can't figure out what logic to implement.