Splunk Enterprise

Propagate value between table rows using streamstats

segantinro
Engager

I have a table like this:

sc1.png

 

 

 

 

 

I would like to propagate "start" value and "end" value if "_time>=start AND _time<end".

It's like a "transaction" with "startwith and endwith", but I need to use "streamstats", because I can't lost event details.

So I would like to obtain:

sc2.png

 

 

 

 

 

 

Thanks

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Given the limited example of what you are trying to do, can you do something with eventstats

| eventstats values(start) as start values(end) as end
| eval start=if(_time>=start AND _time <= end, start, null())
| eval end=if(_time>=start AND _time <= end, end, null())
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...