topic Propagate value between table rows using streamstats in Splunk Enterprise

Propagate value between table rows using streamstats

segantinro — Tue, 31 May 2022 16:03:59 GMT

I have a table like this:

I would like to propagate "start" value and "end" value if "_time>=start AND _time<end".

It's like a "transaction" with "startwith and endwith", but I need to use "streamstats", because I can't lost event details.

So I would like to obtain:

Thanks

Re: Propagate value between table rows using streamstats

ITWhisperer — Tue, 31 May 2022 16:27:12 GMT

Given the limited example of what you are trying to do, can you do something with eventstats

| eventstats values(start) as start values(end) as end | eval start=if(_time>=start AND _time <= end, start, null()) | eval end=if(_time>=start AND _time <= end, end, null())