topic Re: How to pick a values are in sequence using streamstats greater than 8 continuous value in Splunk Search

How to pick a values are in sequence using streamstats greater than 8 continuous value

DataOrg — Wed, 30 Sep 2020 03:42:54 GMT

If a streamstats sequence value is continuous to 1-10 values. i need to pick entire count of data . My search is | streamstats reset_on_change=true count(value_TS) AS Sequence BY incremented TS
for example: if sequence is equal to 4 or greater than 3. i need to pick all 4 values ie(1-4) or else skip
mockUp data
streamsstats
1
2
3
4
1
1
1
2
3

Re: How to pick a values are in sequence using streamstats greater than 8 continuous value

richgalloway — Mon, 13 Jan 2020 13:48:15 GMT

Try this untested search:

...  | streamstats reset_on_change=true count(value_TS) AS Sequence BY incremented TS
| streamstats max(Sequence) as Max
| where Max > 3
| ...

Re: How to pick a values are in sequence using streamstats greater than 8 continuous value

to4kawa — Mon, 13 Jan 2020 14:39:25 GMT

your_search
| streamstats reset_on_change=true count(value_TS) AS Sequence BY incremented TS
| reverse
| streamstats reset_after="Sequence=1" count(eval(Sequence>=4)) as flag
| reverse
| where flag > 0

Hi, @premranjithj
How about this?

Re: How to pick a values are in sequence using streamstats greater than 8 continuous value

somesoni2 — Mon, 13 Jan 2020 14:41:44 GMT

Whats the expected output of your sample data?

Re: How to pick a values are in sequence using streamstats greater than 8 continuous value

DataOrg — Mon, 13 Jan 2020 14:48:17 GMT

the max value is following the change in sequence value too. i need only the first 4 values and if the sequence is followed in other sequence need to pick the fresh set of values

Re: How to pick a values are in sequence using streamstats greater than 8 continuous value

DataOrg — Mon, 13 Jan 2020 15:06:23 GMT

@to4kawa Super !!! thanks 🙂 worked