topic Re: Data of a field in next row in another field of current row in Splunk Search

Data of a field in next row in another field of current row

sunilpanda023 — Tue, 29 Sep 2020 13:50:26 GMT

![alt text][1]

The siuation is - I have sprint and their start date , I want the next sprint start date in same row and for last sprint current date.

Current Result:-
sprint sprint_startDate
Sprint-0 06-March-2017

Sprint-1 29-March-2017

Sprint-2 17-April-2017

Required Result:-
sprint sprint_startDate ** nextsprint_startDate**
Sprint-0 06-March-2017 29-March-2017
Sprint-1 29-March-2017 17-April-2017
Sprint-2 17-April-2017 now()

Re: Data of a field in next row in another field of current row

DalJeanis — Wed, 26 Apr 2017 14:19:47 GMT

| reverse 
| autoregress sprint_startDate as nextsprint_startDate p=1
| reverse
| fillnull value=now() nextsprint_startDate

Updated to fill in the current date for "nextsprint_startDate" for the last sprint. Probably not the right specification, in my experience, but it was the request... 😉

Re: Data of a field in next row in another field of current row

sunilpanda023 — Thu, 27 Apr 2017 01:03:45 GMT

Thank you DalJeanis

I tried with this too and it worked and it has the step function with window to change the step in any case.

| sort - sprintstartDate
| streamstats last(sprintstartDate) as next_sprintstartDate window=1 current=f
| sort  sprintstartDate

| eval next_sprintstartDate=if(isnull(next_sprintstartDate),now()),next_sprintstartDate)