Dashboards & Visualizations

How to create an increment counter that restarts when the variable changes

cherylheng9586
Loves-to-Learn Everything

I am currently using | streamstats count as index by success_rate, but it doesn't work.

 

What i want:

success_rate/Index

pass/0

pass/1

pass/2

fail/0

fail/1

pass/0

pass/1

 

What i am getting:

success_rate/Index

pass/0

pass/1

pass/2

fail/0

fail/1

pass/3

pass/4

 

As can be seen above, when "pass" occurs again, the counter continues from the previous pass.

 

pls help! thank you!!

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Find out where the success_rate changes, get a running total of the number of changes, use this as the group for your index counts (adjust to start index at zero)

| makeresults count=7
| streamstats count as row
| eval success_rate=mvindex(split("pass,pass,pass,fail,fail,pass,pass",","),row-1)
| table success_rate


| streamstats window=1 current=f values(success_rate) as previous_success
| eval change=if(success_rate!=previous_success,1,0)
| streamstats sum(change) as group
| streamstats count as index by group
| eval index=index - 1
| table success_rate index
0 Karma

cherylheng9586
Loves-to-Learn Everything

Hello,

thank you for replying. as i have over 300,000 rows, i am unable to physically count where the changes occurs and hence i couldnt use 

| eval success_rate=mvindex(split("pass,pass,pass,fail,fail,pass,pass",","),row-1)

 

Instead I was able to create this increment counter with this line and it worked well for me.

| streamstats count by "success_rate" reset_on_change=true

 

Just had to add in the "reset_on_change=true" for it to work the way i need it to (:

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The first part before the blank lines including the eval success_rate is just to create some dummy data - you don't need any of the first section.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...