Splunk Enterprise

Propagate value between table rows using streamstats

segantinro
Engager

I have a table like this:

sc1.png

 

 

 

 

 

I would like to propagate "start" value and "end" value if "_time>=start AND _time<end".

It's like a "transaction" with "startwith and endwith", but I need to use "streamstats", because I can't lost event details.

So I would like to obtain:

sc2.png

 

 

 

 

 

 

Thanks

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Given the limited example of what you are trying to do, can you do something with eventstats

| eventstats values(start) as start values(end) as end
| eval start=if(_time>=start AND _time <= end, start, null())
| eval end=if(_time>=start AND _time <= end, end, null())
0 Karma
Get Updates on the Splunk Community!

Monitoring Postgres with OpenTelemetry

Behind every business-critical application, you’ll find databases. These behind-the-scenes stores power ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...