https://community.splunk.com/t5/Splunk-Search/How-to-keep-a-cumulative-value-of-a-field-that-occasionally/m-p/430554#M123095 <P>Hi,<BR /> I have a cumulative counter in a .csv log, the issue is, the software generating the .csv resets this counter from time to time.</P> <P>The file looks like this, the counter is the second value.<BR /> 1005 ,4400.00,<BR /> 1005 ,4450.00, <BR /> 1005 ,0.00, <BR /> 1005 ,0.01, <BR /> 1005 ,30.00, </P> <P>What I look for is away to obtain the value of the counter disregarding resets, so in the example that would be 4480.01</P> <P>I guess this can be done by summing the delta from last to previous value, however I have no Idea how to tell Splunk to ignore the delta when the last value is 0, and resume counting with the last high/non-zero value.</P> <P>Thanks for the help, L</P> Fri, 19 Oct 2018 08:02:17 GMT lbentin 2018-10-19T08:02:17Z https://community.splunk.com/t5/Splunk-Search/How-to-keep-a-cumulative-value-of-a-field-that-occasionally/m-p/430554#M123095 <P>Hi,<BR /> I have a cumulative counter in a .csv log, the issue is, the software generating the .csv resets this counter from time to time.</P> <P>The file looks like this, the counter is the second value.<BR /> 1005 ,4400.00,<BR /> 1005 ,4450.00, <BR /> 1005 ,0.00, <BR /> 1005 ,0.01, <BR /> 1005 ,30.00, </P> <P>What I look for is away to obtain the value of the counter disregarding resets, so in the example that would be 4480.01</P> <P>I guess this can be done by summing the delta from last to previous value, however I have no Idea how to tell Splunk to ignore the delta when the last value is 0, and resume counting with the last high/non-zero value.</P> <P>Thanks for the help, L</P> Fri, 19 Oct 2018 08:02:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-keep-a-cumulative-value-of-a-field-that-occasionally/m-p/430554#M123095 lbentin 2018-10-19T08:02:17Z