Dashboards & Visualizations

How to create an increment counter that restarts when the variable changes

cherylheng9586
Loves-to-Learn Everything

I am currently using | streamstats count as index by success_rate, but it doesn't work.

 

What i want:

success_rate/Index

pass/0

pass/1

pass/2

fail/0

fail/1

pass/0

pass/1

 

What i am getting:

success_rate/Index

pass/0

pass/1

pass/2

fail/0

fail/1

pass/3

pass/4

 

As can be seen above, when "pass" occurs again, the counter continues from the previous pass.

 

pls help! thank you!!

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Find out where the success_rate changes, get a running total of the number of changes, use this as the group for your index counts (adjust to start index at zero)

| makeresults count=7
| streamstats count as row
| eval success_rate=mvindex(split("pass,pass,pass,fail,fail,pass,pass",","),row-1)
| table success_rate


| streamstats window=1 current=f values(success_rate) as previous_success
| eval change=if(success_rate!=previous_success,1,0)
| streamstats sum(change) as group
| streamstats count as index by group
| eval index=index - 1
| table success_rate index
0 Karma

cherylheng9586
Loves-to-Learn Everything

Hello,

thank you for replying. as i have over 300,000 rows, i am unable to physically count where the changes occurs and hence i couldnt use 

| eval success_rate=mvindex(split("pass,pass,pass,fail,fail,pass,pass",","),row-1)

 

Instead I was able to create this increment counter with this line and it worked well for me.

| streamstats count by "success_rate" reset_on_change=true

 

Just had to add in the "reset_on_change=true" for it to work the way i need it to (:

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The first part before the blank lines including the eval success_rate is just to create some dummy data - you don't need any of the first section.

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...