Splunk Search

Create a new field with cumulative count of a unique ID

keithyap
Path Finder

IS there a way I can create a new field with a cumulative count of a unique ID?

For example, currently i have created a transaction which groups events together as "trips", however I would like to give each trip a number.

below is an example of what I am trying to acheive:
initially after using the transaction, the events will look like below. Each transaction event will have a unique vehicle ID, duration of trip and distance travelled.

vehID,Duration,Distance
1,30,40
1,20,30
2,30,40
3,20,30
3,40,50
3,50,60

I would like to add a cumulative count to act as a Trip Number.
vehID,Duration,Distance,tripNo
1,30,40,1
1,20,30,2
2,30,40,1
3,20,30,1
3,40,50,2
3,50,60,3

Could anyone advise how I could achieve the above?

Thanks!

0 Karma
1 Solution

aholzer
Motivator

Use streamstats command:

<your_search> | streamstats count AS tripNo by vehID

Hope this helps

View solution in original post

aholzer
Motivator

Use streamstats command:

<your_search> | streamstats count AS tripNo by vehID

Hope this helps

keithyap
Path Finder

Thanks! that helped.

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...