topic Re: Count values changes only when value in a column changes in Splunk Search

Count values changes only when value in a column changes

nabeel652 — Thu, 11 Jul 2024 05:03:56 GMT

Hello wonderful Splunk community,

I have some data where I want count to change only when status changes:

Status Count
-------------------
Online 1
Online 1
Online 1
Break 2
Break 2
Online 3
Online 3
Lunch 4
Lunch 4
Lunch 4
Offline 5
Offline 5

Any help appreciated.

Re: Count values changes only when value in a column changes

gcusello — Thu, 11 Jul 2024 05:51:34 GMT

Hi @nabeel652 ,

if you already extracted the status field, you could try something like this:

<your_search> | autoregress status as status_old p=1 | table _time status status_old | where NOT status=status_old

Ciao.

Giuseppe

Re: Count values changes only when value in a column changes

nabeel652 — Thu, 11 Jul 2024 06:02:34 GMT

Thank you for the reply 🙂

I was able to achieve the same with

| streamstats reset_on_change=true count by Activity
| where count==1

But I want a count field that just increments when it senses a change in status.
so I can do my
| stats earliest(_time) as startTime, latest(_time) as endTime by status, count
or something like that...

Re: Count values changes only when value in a column changes

gcusello — Thu, 11 Jul 2024 06:09:23 GMT

Hi @nabeel652 ,

did you tried with accum?

Ciao.

Giuseppe

Re: Count values changes only when value in a column changes

nabeel652 — Fri, 12 Jul 2024 00:10:09 GMT

Thank you

I don't want to omit any records. This sort of gives me the required results but records are missing which I don't want. I want same number of rows after the solution is applied.

Re: Count values changes only when value in a column changes

gcusello — Fri, 12 Jul 2024 06:41:05 GMT

Hi @nabeel652 ,

ok, please try this:

that I tested (and runs) in this way:

Ciao.

Giuseppe

Re: Count values changes only when value in a column changes

nabeel652 — Fri, 12 Jul 2024 09:33:07 GMT

I was able to do it by some other way but your solution is cleaner and elegant. Thanks for the help