Dashboards & Visualizations

How to create an increment counter that restarts when the variable changes

cherylheng9586
Loves-to-Learn Everything

I am currently using | streamstats count as index by success_rate, but it doesn't work.

 

What i want:

success_rate/Index

pass/0

pass/1

pass/2

fail/0

fail/1

pass/0

pass/1

 

What i am getting:

success_rate/Index

pass/0

pass/1

pass/2

fail/0

fail/1

pass/3

pass/4

 

As can be seen above, when "pass" occurs again, the counter continues from the previous pass.

 

pls help! thank you!!

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Find out where the success_rate changes, get a running total of the number of changes, use this as the group for your index counts (adjust to start index at zero)

| makeresults count=7
| streamstats count as row
| eval success_rate=mvindex(split("pass,pass,pass,fail,fail,pass,pass",","),row-1)
| table success_rate


| streamstats window=1 current=f values(success_rate) as previous_success
| eval change=if(success_rate!=previous_success,1,0)
| streamstats sum(change) as group
| streamstats count as index by group
| eval index=index - 1
| table success_rate index
0 Karma

cherylheng9586
Loves-to-Learn Everything

Hello,

thank you for replying. as i have over 300,000 rows, i am unable to physically count where the changes occurs and hence i couldnt use 

| eval success_rate=mvindex(split("pass,pass,pass,fail,fail,pass,pass",","),row-1)

 

Instead I was able to create this increment counter with this line and it worked well for me.

| streamstats count by "success_rate" reset_on_change=true

 

Just had to add in the "reset_on_change=true" for it to work the way i need it to (:

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The first part before the blank lines including the eval success_rate is just to create some dummy data - you don't need any of the first section.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!