https://community.splunk.com/t5/Splunk-Search/Calculating-the-number-of-executions-using-streamstats/m-p/254403#M76187 <P>Try this</P> <PRE><CODE>your current search giving package executionID type day time | eval count=if(type="start",1,0) | streamstats sum(count) as count by day </CODE></PRE> Fri, 14 Oct 2016 14:28:07 GMT somesoni2 2016-10-14T14:28:07Z https://community.splunk.com/t5/Splunk-Search/Calculating-the-number-of-executions-using-streamstats/m-p/254402#M76186 <P>Hi! I have such table:</P> <P>package executionID type day time<BR /> A 1 start day1 some_hour<BR /> A 1 end day1 some_hour<BR /> B 1 start day1 some_hour<BR /> B 2 start day1 some_hour<BR /> B 2 end day1 some_hour</P> <P>Id like to identify (counting) the execution, so obtaining something like this:</P> <P>A 1 start day1 some_hour 1 (start of the first exec of package A in day1)<BR /> A 1 end day1 some_hour 1 (end of the first exec of package A in day1)<BR /> B 1 start day1 some_hour 1 (start of the first exec of package B in day1)<BR /> B 2 start day1 some_hour 2 (start of the second exec of package B in day1)<BR /> B 2 end day1 some_hour 2 (end of the second exec of package B in day1)</P> <P>I tried everything i could with streamstats but i could not do it.</P> <P>Thank you</P> Tue, 29 Sep 2020 11:25:31 GMT https://community.splunk.com/t5/Splunk-Search/Calculating-the-number-of-executions-using-streamstats/m-p/254402#M76186 andreafebbo 2020-09-29T11:25:31Z https://community.splunk.com/t5/Splunk-Search/Calculating-the-number-of-executions-using-streamstats/m-p/254403#M76187 <P>Try this</P> <PRE><CODE>your current search giving package executionID type day time | eval count=if(type="start",1,0) | streamstats sum(count) as count by day </CODE></PRE> Fri, 14 Oct 2016 14:28:07 GMT https://community.splunk.com/t5/Splunk-Search/Calculating-the-number-of-executions-using-streamstats/m-p/254403#M76187 somesoni2 2016-10-14T14:28:07Z