Dashboards & Visualizations

How to create an increment counter that restarts when the variable changes

cherylheng9586
Loves-to-Learn Everything

I am currently using | streamstats count as index by success_rate, but it doesn't work.

 

What i want:

success_rate/Index

pass/0

pass/1

pass/2

fail/0

fail/1

pass/0

pass/1

 

What i am getting:

success_rate/Index

pass/0

pass/1

pass/2

fail/0

fail/1

pass/3

pass/4

 

As can be seen above, when "pass" occurs again, the counter continues from the previous pass.

 

pls help! thank you!!

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Find out where the success_rate changes, get a running total of the number of changes, use this as the group for your index counts (adjust to start index at zero)

| makeresults count=7
| streamstats count as row
| eval success_rate=mvindex(split("pass,pass,pass,fail,fail,pass,pass",","),row-1)
| table success_rate


| streamstats window=1 current=f values(success_rate) as previous_success
| eval change=if(success_rate!=previous_success,1,0)
| streamstats sum(change) as group
| streamstats count as index by group
| eval index=index - 1
| table success_rate index
0 Karma

cherylheng9586
Loves-to-Learn Everything

Hello,

thank you for replying. as i have over 300,000 rows, i am unable to physically count where the changes occurs and hence i couldnt use 

| eval success_rate=mvindex(split("pass,pass,pass,fail,fail,pass,pass",","),row-1)

 

Instead I was able to create this increment counter with this line and it worked well for me.

| streamstats count by "success_rate" reset_on_change=true

 

Just had to add in the "reset_on_change=true" for it to work the way i need it to (:

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The first part before the blank lines including the eval success_rate is just to create some dummy data - you don't need any of the first section.

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...