topic Re: increment count in a field based on field values.. in Splunk Search

increment count in a field based on field values..

jiaqya — Thu, 27 Aug 2020 19:30:52 GMT

Need help with a situation.

Example table below:

column1,column2,column3,_time

1,2,3,21st

1,2,3,22nd

1,2,3,23rd

3,2,1,23rd

4,5,6,23rd

if on multiple days/times, column1 ,2 and 3 are same(4th column is _time ) , then add a new field(count) with incrementing numbers by _time , like below. how can this be done ? need help with query..

column1,column2,column3,_time,count

1,2,3,21st,1

1,2,3,22nd,2

1,2,3,23rd,3

3,2,1,23rd,1

4,5,6,23rd,1

Re: increment count in a field based on field values..

thambisetty — Thu, 27 Aug 2020 19:40:03 GMT

| bin _time span=1d
| stats count by column1,column2,column3_time

| streamstats count by column1,column2,column3

Re: increment count in a field based on field values..

jiaqya — Wed, 02 Sep 2020 18:22:56 GMT

Works perfectly fine, thank you...