https://community.splunk.com/t5/Splunk-Search/Tracking-state-changes/m-p/545528#M154543 <P>Hi</P><P>you could try&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchReference/Streamstats" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchReference/Streamstats</A>&nbsp;with reset_on_change attribute.</P><P>r. Ismo</P> Fri, 26 Mar 2021 07:02:29 GMT isoutamo 2021-03-26T07:02:29Z https://community.splunk.com/t5/Splunk-Search/Tracking-state-changes/m-p/545479#M154514 <P>I'm trying to track state changes but having a difficult time. Ideally I'd like to know when a state changes from 0 to either 1, 2 or 3 and then back to 0, capturing the event's date/time that the value changed initially from 0 until it goes back to 0 in a dashboard panel. Is that possible?</P> Thu, 25 Mar 2021 21:08:16 GMT https://community.splunk.com/t5/Splunk-Search/Tracking-state-changes/m-p/545479#M154514 redgoat 2021-03-25T21:08:16Z https://community.splunk.com/t5/Splunk-Search/Tracking-state-changes/m-p/545528#M154543 <P>Hi</P><P>you could try&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchReference/Streamstats" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchReference/Streamstats</A>&nbsp;with reset_on_change attribute.</P><P>r. Ismo</P> Fri, 26 Mar 2021 07:02:29 GMT https://community.splunk.com/t5/Splunk-Search/Tracking-state-changes/m-p/545528#M154543 isoutamo 2021-03-26T07:02:29Z https://community.splunk.com/t5/Splunk-Search/Tracking-state-changes/m-p/545651#M154608 <P>Thank you, that works!</P> Fri, 26 Mar 2021 19:10:42 GMT https://community.splunk.com/t5/Splunk-Search/Tracking-state-changes/m-p/545651#M154608 redgoat 2021-03-26T19:10:42Z