Dashboards & Visualizations

How to create an increment counter that restarts when the variable changes

cherylheng9586
Loves-to-Learn Everything

I am currently using | streamstats count as index by success_rate, but it doesn't work.

 

What i want:

success_rate/Index

pass/0

pass/1

pass/2

fail/0

fail/1

pass/0

pass/1

 

What i am getting:

success_rate/Index

pass/0

pass/1

pass/2

fail/0

fail/1

pass/3

pass/4

 

As can be seen above, when "pass" occurs again, the counter continues from the previous pass.

 

pls help! thank you!!

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Find out where the success_rate changes, get a running total of the number of changes, use this as the group for your index counts (adjust to start index at zero)

| makeresults count=7
| streamstats count as row
| eval success_rate=mvindex(split("pass,pass,pass,fail,fail,pass,pass",","),row-1)
| table success_rate


| streamstats window=1 current=f values(success_rate) as previous_success
| eval change=if(success_rate!=previous_success,1,0)
| streamstats sum(change) as group
| streamstats count as index by group
| eval index=index - 1
| table success_rate index
0 Karma

cherylheng9586
Loves-to-Learn Everything

Hello,

thank you for replying. as i have over 300,000 rows, i am unable to physically count where the changes occurs and hence i couldnt use 

| eval success_rate=mvindex(split("pass,pass,pass,fail,fail,pass,pass",","),row-1)

 

Instead I was able to create this increment counter with this line and it worked well for me.

| streamstats count by "success_rate" reset_on_change=true

 

Just had to add in the "reset_on_change=true" for it to work the way i need it to (:

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The first part before the blank lines including the eval success_rate is just to create some dummy data - you don't need any of the first section.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...