topic Re: Group by repeating value at value change in Splunk Search

Group by repeating value at value change

aseadmin — Tue, 16 Jun 2020 06:46:50 GMT

Hi, I require a little help here as i having spent a lot of time researching for a solution without any luck

I have a vehicle idling data where the data is like below,

MACHINE STATUS

A 1

A 0

A 1

can i get a consolidated view from the above data in below consolidated way ?

MACHINE STATUS COUNT

A 1 3

A 0 2

A 1 2

I wanted the data in the above way, so that i know for long the machine was idling at various part of time rather than how long the machine was idling during a filtered time

any help will be much appreciated.

Thank you

Re: Group by repeating value at value change

kamlesh_vaghela — Tue, 16 Jun 2020 07:14:13 GMT

@aseadmin

Can you please try this?

Sample Search:

Re: Group by repeating value at value change

bowesmana — Tue, 16 Jun 2020 07:29:40 GMT

This will give you the exact result from your example, but I am pretty sure it's an inelegant solution that can be improved on...

Re: Group by repeating value at value change

aseadmin — Tue, 16 Jun 2020 07:54:46 GMT

@kamlesh_vaghela thanks kamlesh. thats what i was looking at. Just to add to that, if i need to get a max and min value of a field in this grouping say "fan_speed" or "cpu_load" values which i have, where would i add those evaluations ?

Re: Group by repeating value at value change

kamlesh_vaghela — Tue, 16 Jun 2020 09:23:04 GMT

@aseadmin

Can you pleas share some sample event or table same like you shared in question ? So we can help you on

Re: Group by repeating value at value change

aseadmin — Tue, 16 Jun 2020 12:32:14 GMT

No worries, i found a way out extending from your query. The query you shared was what i required to start with (a solution i didn't find anywhere). Thanks once again.