topic Re: What this query will do? in Splunk Search

What this query will do?

harshal94 — Thu, 22 Mar 2018 07:57:23 GMT

streamstats current=f latest(up) as oldUP by lowername
I am bit confused what will streamstats calculate here?

Re: What this query will do?

cmerriman — Thu, 22 Mar 2018 11:47:20 GMT

streamstats basically grabs all of the previous events within the set parameters. you are not setting a window to only grab the previous event, or previous 10 events (window=10), so it'll search all previous events. current=f will exclude the current event. it does this for every event in your dataset. so your search will grab the latest seen up value from every event before the current event and add a field called oldUP to the current event, by lowername.
something like this:

up  lowername   oldUP
foo1    bar1    
foo2    bar1    foo1
foo3    bar1    foo2
foo4    bar1    foo3
foo5    bar1    foo4
foo6    bar1    foo5
foo7    bar2    
foo8    bar2    foo7
foo1    bar2    foo8
foo2    bar2    foo1

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Streamstats

Re: What this query will do?

kamlesh_vaghela — Thu, 22 Mar 2018 11:51:09 GMT

Hi @harshal94,

In this search streamstats calculating latest value of up field by lowername. Here you will get oldUP as new filed. Here you set current=false & If current=false, the search uses the field value from the previous event.

Please check below doc for more information.

http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Streamstats