https://community.splunk.com/t5/Splunk-Search/incremental-value/m-p/459470#M168050 <P>its not sum.<BR /> we need to have a sequence of no if value are same we need to mark it as 1 . if current sequence changes to other set of no. we need to increase the value by 1</P> Mon, 30 Jul 2018 10:19:21 GMT DataOrg 2018-07-30T10:19:21Z https://community.splunk.com/t5/Splunk-Search/incremental-value/m-p/459468#M168048 <P>I have sequence no of to populate . first column is the sequence of no and answers need to like in the second column</P> <P>for Example<BR /> value value to populate<BR /> 10 1<BR /> 10 1<BR /> 10 1<BR /> 15 2<BR /> 15 2<BR /> 10 3</P> Mon, 30 Jul 2018 09:56:38 GMT https://community.splunk.com/t5/Splunk-Search/incremental-value/m-p/459468#M168048 DataOrg 2018-07-30T09:56:38Z https://community.splunk.com/t5/Splunk-Search/incremental-value/m-p/459469#M168049 <P>If increment is added for every NO ...</P> <PRE><CODE>(your search)| streamstats sum(value) by no </CODE></PRE> Mon, 30 Jul 2018 10:07:31 GMT https://community.splunk.com/t5/Splunk-Search/incremental-value/m-p/459469#M168049 HiroshiSatoh 2018-07-30T10:07:31Z https://community.splunk.com/t5/Splunk-Search/incremental-value/m-p/459470#M168050 <P>its not sum.<BR /> we need to have a sequence of no if value are same we need to mark it as 1 . if current sequence changes to other set of no. we need to increase the value by 1</P> Mon, 30 Jul 2018 10:19:21 GMT https://community.splunk.com/t5/Splunk-Search/incremental-value/m-p/459470#M168050 DataOrg 2018-07-30T10:19:21Z https://community.splunk.com/t5/Splunk-Search/incremental-value/m-p/459471#M168051 <P>How's this?</P> <PRE><CODE> (your search) |autoregress p=1 no as no_old |eval change=if(no=no_old,0,1) | streamstats sum(change) as inc_value |table no inc_value </CODE></PRE> Mon, 30 Jul 2018 13:41:28 GMT https://community.splunk.com/t5/Splunk-Search/incremental-value/m-p/459471#M168051 HiroshiSatoh 2018-07-30T13:41:28Z