Splunk Search

Alternative to filldown function

hmahendrakumar
Path Finder

I have some gaps in my data. I want to fill those gaps only when I visualize it.I have some filler events created via gentimes. I found filldown can be used to get the last known value for a field in these filler events. My problem is filldown is supported only in 4.2 & later. We are using 4.1 now.

Is there an alternative way to achieve the same ?

Eg:-

Before filldown

Time Count

12:00 >1

12:01

12:02

.

.

12:10 > 17

12:11

After filldown

12:00 > 1

12:01 > 1

12:02 > 1

.

.

12:10 > 17

12:11 > 17

Tags (2)
1 Solution

sideview
SplunkTrust
SplunkTrust

I'm pretty sure streamstats can do this:

| streamstats last(count) as count 

Streamstats has an argument called current, and the default value is t. Which means that as it's operating on each event it will include the current event in the total.

If for some reason you wanted to keep the most recent value separate from the current count, you could do:

| streamstats current=f last(count) as previousCount 

http://www.splunk.com/base/Documentation/latest/SearchReference/Streamstats

View solution in original post

sideview
SplunkTrust
SplunkTrust

I'm pretty sure streamstats can do this:

| streamstats last(count) as count 

Streamstats has an argument called current, and the default value is t. Which means that as it's operating on each event it will include the current event in the total.

If for some reason you wanted to keep the most recent value separate from the current count, you could do:

| streamstats current=f last(count) as previousCount 

http://www.splunk.com/base/Documentation/latest/SearchReference/Streamstats

hmahendrakumar
Path Finder

Thanks nick.. I had an even more older version(splunk 4.0) in my dev env where streamstats wasnt working.. it works in 4.1+

0 Karma

hmahendrakumar
Path Finder

let me know if i am not clear enough

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...