https://community.splunk.com/t5/Splunk-Search/assigning-repeating-rolling-sequential-field/m-p/467103#M131456 <P>I am looking to have a new field that will assign a reference to each, this reference will be sequential and will repeat.</P> <P>e.g.<BR /> Record . . . ref<BR /> 1, 6, 11 . . . 1<BR /> 2, 7, 12 . . . 2<BR /> but the number of records is going to change as will the number for the first record so it needs to work on the order of the records.<BR /> I had thought stream stats but can't see a way to make it work.</P> <P>Many thanks for any help </P> Tue, 17 Dec 2019 17:25:56 GMT ChrisCLewis 2019-12-17T17:25:56Z https://community.splunk.com/t5/Splunk-Search/assigning-repeating-rolling-sequential-field/m-p/467103#M131456 <P>I am looking to have a new field that will assign a reference to each, this reference will be sequential and will repeat.</P> <P>e.g.<BR /> Record . . . ref<BR /> 1, 6, 11 . . . 1<BR /> 2, 7, 12 . . . 2<BR /> but the number of records is going to change as will the number for the first record so it needs to work on the order of the records.<BR /> I had thought stream stats but can't see a way to make it work.</P> <P>Many thanks for any help </P> Tue, 17 Dec 2019 17:25:56 GMT https://community.splunk.com/t5/Splunk-Search/assigning-repeating-rolling-sequential-field/m-p/467103#M131456 ChrisCLewis 2019-12-17T17:25:56Z https://community.splunk.com/t5/Splunk-Search/assigning-repeating-rolling-sequential-field/m-p/467104#M131457 <P>It's unclear how the 'Ref' column is to be computed. Please explain.</P> Tue, 17 Dec 2019 20:34:44 GMT https://community.splunk.com/t5/Splunk-Search/assigning-repeating-rolling-sequential-field/m-p/467104#M131457 richgalloway 2019-12-17T20:34:44Z https://community.splunk.com/t5/Splunk-Search/assigning-repeating-rolling-sequential-field/m-p/467105#M131458 <P>+1 to what @richgalloway said. Ideally you can give us a few more example logs and the edge cases you want the code to be able to handle, as well as why streamstats won't work. Thanks!</P> Tue, 17 Dec 2019 22:13:41 GMT https://community.splunk.com/t5/Splunk-Search/assigning-repeating-rolling-sequential-field/m-p/467105#M131458 aberkow 2019-12-17T22:13:41Z https://community.splunk.com/t5/Splunk-Search/assigning-repeating-rolling-sequential-field/m-p/467106#M131459 <P>Hi, </P> <P>Thank you for getting back. </P> <P>What is in the logs will not determine what the reference number would be.<BR /> I am looking at a fixed range of references e.g. 1 through 5 (could also easily be a through e) and the earliest / record would take a reference of one<BR /> 2nd, a ref of 2<BR /> 3rd, a ref of 3<BR /> 4th, a ref of 4<BR /> 5th, a ref of 5<BR /> 6th, a ref of 1<BR /> 7th, a ref of 2<BR /> ...<BR /> 10th, a ref of 5<BR /> 11th, a ref of 1 etc<BR /> this would continue through all records until they all have a ref from the 1 through 5 range.</P> <P>There could easily be 5 million records to go through.</P> <P>Many thanks</P> Wed, 18 Dec 2019 09:19:10 GMT https://community.splunk.com/t5/Splunk-Search/assigning-repeating-rolling-sequential-field/m-p/467106#M131459 ChrisCLewis 2019-12-18T09:19:10Z https://community.splunk.com/t5/Splunk-Search/assigning-repeating-rolling-sequential-field/m-p/467107#M131460 <PRE><CODE>| makeresults count=5000 | streamstats current=f count | eval ref = "a ref of ".((count % 5) + 1) </CODE></PRE> <P>Hi, @ChrisCLewis<BR /> My machine can't work with <CODE>count=500000000</CODE> <BR /> but , your machine will work.</P> Wed, 18 Dec 2019 13:07:11 GMT https://community.splunk.com/t5/Splunk-Search/assigning-repeating-rolling-sequential-field/m-p/467107#M131460 to4kawa 2019-12-18T13:07:11Z https://community.splunk.com/t5/Splunk-Search/assigning-repeating-rolling-sequential-field/m-p/467108#M131461 <P>Many thanks for the answer, never clocked the "current=f" option...</P> Wed, 18 Dec 2019 14:04:21 GMT https://community.splunk.com/t5/Splunk-Search/assigning-repeating-rolling-sequential-field/m-p/467108#M131461 ChrisCLewis 2019-12-18T14:04:21Z