Archive

Alternative to filldown function

Path Finder

I have some gaps in my data. I want to fill those gaps only when I visualize it.I have some filler events created via gentimes. I found filldown can be used to get the last known value for a field in these filler events. My problem is filldown is supported only in 4.2 & later. We are using 4.1 now.

Is there an alternative way to achieve the same ?

Eg:-

Before filldown

Time Count

12:00 >1

12:01

12:02

.

.

12:10 > 17

12:11

After filldown

12:00 > 1

12:01 > 1

12:02 > 1

.

.

12:10 > 17

12:11 > 17

Tags (2)
1 Solution

SplunkTrust
SplunkTrust

I'm pretty sure streamstats can do this:

| streamstats last(count) as count 

Streamstats has an argument called current, and the default value is t. Which means that as it's operating on each event it will include the current event in the total.

If for some reason you wanted to keep the most recent value separate from the current count, you could do:

| streamstats current=f last(count) as previousCount 

http://www.splunk.com/base/Documentation/latest/SearchReference/Streamstats

View solution in original post

SplunkTrust
SplunkTrust

I'm pretty sure streamstats can do this:

| streamstats last(count) as count 

Streamstats has an argument called current, and the default value is t. Which means that as it's operating on each event it will include the current event in the total.

If for some reason you wanted to keep the most recent value separate from the current count, you could do:

| streamstats current=f last(count) as previousCount 

http://www.splunk.com/base/Documentation/latest/SearchReference/Streamstats

View solution in original post

Path Finder

Thanks nick.. I had an even more older version(splunk 4.0) in my dev env where streamstats wasnt working.. it works in 4.1+

0 Karma

Path Finder

let me know if i am not clear enough

0 Karma