topic Re: How to combine events with counting? in Splunk Search

How to combine events with counting?

rendie — Wed, 16 Jun 2021 11:25:48 GMT

Hi folks,

Just a quick question. For example, a have a dataset

_time	field_x	field_y
14:01	0	0
14:02	0	1
14:03	0	2
14:04	1	3
14:05	1	0
14:06	0	0
14:07	1	1
14:08	1	0

If describe this logic in text: field_x is a random number 0 or 1. field_y is how many 0 was in previous events for field_x.

Re: How to combine events with counting?

ITWhisperer — Wed, 16 Jun 2021 13:04:15 GMT

I changed field_x to As and Bs to show that non-numerics can be dealt with, you just need to compare to one of the values. I recreated field_y and field_z so you can see the process matches your requirement.

| makeresults | eval _raw="_time field_x field_y 14:01 A 0 14:02 A 1 14:03 A 2 14:04 B 3 14:05 B 0 14:06 A 0 14:07 B 1 14:08 B 0" | multikv forceheader=1 | fields - _* linecount | streamstats window=1 current=f values(field_x) as previous | eval previous_match=if(previous="A",1,0) | streamstats window=1 current=f values(previous_match) as previous | eval groupstart=if(previous_match=1 AND previous=0,1,0) | streamstats sum(groupstart) as group | eval group=if(previous_match=1,group,null) | streamstats sum(previous_match) as field_z by group | fillnull value=0 field_z

Re: How to combine events with counting?

kamlesh_vaghela — Wed, 16 Jun 2021 17:57:44 GMT

@rendie

Can you please try this?

My Sample Search :

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: How to combine events with counting?

rendie — Fri, 18 Jun 2021 09:13:42 GMT

I'm sorry if my question was not complete. The fact is that initially, I do not have an X field, I create it using | eval field_x = if(fieldValue >= fieldThreshold, 1, 0)

Re: How to combine events with counting?

rendie — Fri, 18 Jun 2021 09:14:15 GMT

I'm sorry if my question was not complete. The fact is that initially, I do not have an X field, I create it using | eval field_x = if(fieldValue >= fieldThreshold, 1, 0).