Create a new field with cumulative count of a unique ID

keithyap — Fri, 30 Oct 2015 06:08:30 GMT

IS there a way I can create a new field with a cumulative count of a unique ID?

For example, currently i have created a transaction which groups events together as "trips", however I would like to give each trip a number.

below is an example of what I am trying to acheive:
initially after using the transaction, the events will look like below. Each transaction event will have a unique vehicle ID, duration of trip and distance travelled.

vehID,Duration,Distance
1,30,40
1,20,30
2,30,40
3,20,30
3,40,50
3,50,60

I would like to add a cumulative count to act as a Trip Number.
vehID,Duration,Distance,tripNo
1,30,40,1
1,20,30,2
2,30,40,1
3,20,30,1
3,40,50,2
3,50,60,3

Could anyone advise how I could achieve the above?

Thanks!

Re: Create a new field with cumulative count of a unique ID

aholzer — Fri, 30 Oct 2015 12:59:29 GMT

Use streamstats command:

<your_search> | streamstats count AS tripNo by vehID

Hope this helps

Re: Create a new field with cumulative count of a unique ID

keithyap — Mon, 02 Nov 2015 01:48:20 GMT

Thanks! that helped.

topic Re: Create a new field with cumulative count of a unique ID in Splunk Search

Create a new field with cumulative count of a unique ID

Re: Create a new field with cumulative count of a unique ID

Re: Create a new field with cumulative count of a unique ID