https://community.splunk.com/t5/Splunk-Search/How-handle-time-based-join-with-streamstats/m-p/175423#M50363 <P>This should get you started:</P> <PRE><CODE>sourcetype=registration OR sourcetype=status | eventstats latest(state) AS finalState BY host | streamstats current=t last(state) AS currentState by host | stats count(eval(sourcetype=registration AND currentState="RUNNING")) by host </CODE></PRE> Fri, 26 Jun 2015 16:31:34 GMT woodcock 2015-06-26T16:31:34Z https://community.splunk.com/t5/Splunk-Search/How-handle-time-based-join-with-streamstats/m-p/175421#M50361 <P>I have 2 sets of events, 1 for registration events, and 1 for host state events. There is a common field between the 2 sets of events which is the host. In the individual registration events, I need to know what the last known state for the host is so I can keep a running total of the number of registrations that have occurred. For certain states, the count should get reset.</P> <P>For the last part, I know I'll need to create a field using eval to say what the increment/decrement value for the total is and then do a streamstats based upon the host name and state but correlating those values into the registration events has proven complicated.</P> <P>Any thoughts as to how to do this?</P> Wed, 24 Jun 2015 19:46:43 GMT https://community.splunk.com/t5/Splunk-Search/How-handle-time-based-join-with-streamstats/m-p/175421#M50361 kwalking 2015-06-24T19:46:43Z https://community.splunk.com/t5/Splunk-Search/How-handle-time-based-join-with-streamstats/m-p/175422#M50362 <P>Rather, not just should certain states reset the count, but the registrations should only be counted while the host is in the 'RUNNING' state.</P> Wed, 24 Jun 2015 21:09:31 GMT https://community.splunk.com/t5/Splunk-Search/How-handle-time-based-join-with-streamstats/m-p/175422#M50362 kwalking 2015-06-24T21:09:31Z https://community.splunk.com/t5/Splunk-Search/How-handle-time-based-join-with-streamstats/m-p/175423#M50363 <P>This should get you started:</P> <PRE><CODE>sourcetype=registration OR sourcetype=status | eventstats latest(state) AS finalState BY host | streamstats current=t last(state) AS currentState by host | stats count(eval(sourcetype=registration AND currentState="RUNNING")) by host </CODE></PRE> Fri, 26 Jun 2015 16:31:34 GMT https://community.splunk.com/t5/Splunk-Search/How-handle-time-based-join-with-streamstats/m-p/175423#M50363 woodcock 2015-06-26T16:31:34Z