topic Re: How to best use streamstats command with optional arguments, reset_after or reset_before? in Splunk Search

How to best use streamstats command with optional arguments, reset_after or reset_before?

MsherVin — Tue, 01 Nov 2016 23:37:21 GMT

Does anyone have an example of how to use:

reset_after="(" < eval-expression > ")"

and

reset_before="(" < eval-expression > ")"

with streamstats?

For example, I would like to try something to the effects of:

_time , shift , count
11/1/16 5:11:00.000 PM, DAY, 1
11/1/16 5:12:00.000 PM, DAY, 2
11/1/16 5:13:00.000 PM, NIGHT, 1
11/1/16 5:14:00.000 PM, NIGHT, 2
11/1/16 5:15:00.000 PM, NIGHT, 1
11/1/16 5:16:00.000 PM, NIGHT, 2
11/1/16 5:17:00.000 PM, DAY, 1
11/1/16 5:18:00.000 PM, NIGHT, 3

where the value of eval-expression would be reset after 11/1/16 5:14:00.000 PM (in epoch format or else) in this case.

Thank you thank you!

Re: How to best use streamstats command with optional arguments, reset_after or reset_before?

lquinn — Wed, 02 Nov 2016 03:55:56 GMT

So I had a bit of a play around with this data set. I got part way to the answer. When I converted the timestamp to epoch it seemed to give the expected result using the following:

base_search | eval Time=_time | streamstats count by shift reset_on_change="Time=1478020440"

However when trying to use the _time field, it did not give the same result. I also had problems when using strings in general. Perhaps you can only use numbers?? Anyone else have a solution for use where the field value is a string?

Re: How to best use streamstats command with optional arguments, reset_after or reset_before?

niketn — Tue, 27 Dec 2016 06:24:10 GMT

Double quotes in the evaluation expression within reset_before or reset_after should be escaped with backslash (\). Since you are switching by static time in this case you don't need by shift as a streamstats split field.

 base_search | eval Time=strftime(_time,"%m/%d/%y %H:%M:%S.%3N %p")  | streamstats count as shift reset_after="("match(Time,\"11/01/16 05:14:00.000 AM\")")"