Splunk Search

Alternative to filldown function

hmahendrakumar
Path Finder

I have some gaps in my data. I want to fill those gaps only when I visualize it.I have some filler events created via gentimes. I found filldown can be used to get the last known value for a field in these filler events. My problem is filldown is supported only in 4.2 & later. We are using 4.1 now.

Is there an alternative way to achieve the same ?

Eg:-

Before filldown

Time Count

12:00 >1

12:01

12:02

.

.

12:10 > 17

12:11

After filldown

12:00 > 1

12:01 > 1

12:02 > 1

.

.

12:10 > 17

12:11 > 17

Tags (2)
1 Solution

sideview
SplunkTrust
SplunkTrust

I'm pretty sure streamstats can do this:

| streamstats last(count) as count 

Streamstats has an argument called current, and the default value is t. Which means that as it's operating on each event it will include the current event in the total.

If for some reason you wanted to keep the most recent value separate from the current count, you could do:

| streamstats current=f last(count) as previousCount 

http://www.splunk.com/base/Documentation/latest/SearchReference/Streamstats

View solution in original post

sideview
SplunkTrust
SplunkTrust

I'm pretty sure streamstats can do this:

| streamstats last(count) as count 

Streamstats has an argument called current, and the default value is t. Which means that as it's operating on each event it will include the current event in the total.

If for some reason you wanted to keep the most recent value separate from the current count, you could do:

| streamstats current=f last(count) as previousCount 

http://www.splunk.com/base/Documentation/latest/SearchReference/Streamstats

hmahendrakumar
Path Finder

Thanks nick.. I had an even more older version(splunk 4.0) in my dev env where streamstats wasnt working.. it works in 4.1+

0 Karma

hmahendrakumar
Path Finder

let me know if i am not clear enough

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...