topic Re: Count of consecutive like events. in Splunk Search

Count of consecutive like events.

topleyg — Tue, 29 Oct 2013 09:16:15 GMT

Hi all,

Is there a way to produce a count of consecutive like events in Splunk?

Example Logs

bookingEvent

failureEvent

bookingEvent

Example Desired Output

bookingEvent 4

failureEvent 2

bookingEvent 2

Re: Count of consecutive like events.

alacercogitatus — Mon, 28 Sep 2020 15:07:18 GMT

It would be best to assign each value to a field. Then you can do:

your_search | stats count by type_event

where type_event = bookingEvent OR type_event = failureEvent.

But just based on your raw data above, this should work:

your_search | rex field=_raw "(?<type_event>\w+)Event" | stats count by type_event

Re: Count of consecutive like events.

topleyg — Tue, 29 Oct 2013 11:45:09 GMT

thanks alacercogitatus, this gives a count of all events over the time period which is not what I want. I want to produce a count of the consecutive like events.

Re: Count of consecutive like events.

alacercogitatus — Tue, 29 Oct 2013 11:48:01 GMT

Do you have any other data in the log?

Re: Count of consecutive like events.

topleyg — Tue, 29 Oct 2013 12:21:22 GMT

there is other data yes, i have simplified it for the purpose of this question.

Re: Count of consecutive like events.

alacercogitatus — Tue, 29 Oct 2013 12:39:35 GMT

The other data might be needed to properly correlate these events.

Re: Count of consecutive like events.

abhishekgupta61 — Fri, 20 Jul 2018 13:03:15 GMT

Hi,

I have similar issue and I have one more column Date with the column he shared.

Date : Status
1/1/2018 : Green
1/2/2018 : Green
1/3/2018 : Red
1/4/2018 : Green
1/5/2018 : Red

Desired result is :
Status : Count
Green : 2
Red : 1
Green : 1
Red : 1

Re: Count of consecutive like events.

HeinzWaescher — Fri, 20 Jul 2018 13:45:50 GMT

Let's say your field is "eventName", try something like

 |  autoregress eventName
 |  eval consecutiveEvent=if(eventName_p1=eventName, 1, 0)
 | streamstats current=t count(eval(consecutiveEvent=0)) AS eventGroup
 |  stats values(eventName) AS eventName, count BY eventGroup

Re: Count of consecutive like events.

KailA — Fri, 20 Jul 2018 15:58:32 GMT

Hi,

Let's try something and tell me if it work.

If your field is TypeEvent

you search
| streamstats count as NbrOfConsecuviteEvents BY TypeEvent reset_on_change=true
| reverse
| streamstats count as nb BY TypeEvent reset_on_change=true
| where nb=1

Hope it helps

KailA

Re: Count of consecutive like events.

abhishekgupta61 — Tue, 24 Jul 2018 14:28:13 GMT

Thanks for your help. It works for me.