Splunk Search

Create a new field with cumulative count of a unique ID

keithyap
Path Finder

IS there a way I can create a new field with a cumulative count of a unique ID?

For example, currently i have created a transaction which groups events together as "trips", however I would like to give each trip a number.

below is an example of what I am trying to acheive:
initially after using the transaction, the events will look like below. Each transaction event will have a unique vehicle ID, duration of trip and distance travelled.

vehID,Duration,Distance
1,30,40
1,20,30
2,30,40
3,20,30
3,40,50
3,50,60

I would like to add a cumulative count to act as a Trip Number.
vehID,Duration,Distance,tripNo
1,30,40,1
1,20,30,2
2,30,40,1
3,20,30,1
3,40,50,2
3,50,60,3

Could anyone advise how I could achieve the above?

Thanks!

0 Karma
1 Solution

aholzer
Motivator

Use streamstats command:

<your_search> | streamstats count AS tripNo by vehID

Hope this helps

View solution in original post

aholzer
Motivator

Use streamstats command:

<your_search> | streamstats count AS tripNo by vehID

Hope this helps

keithyap
Path Finder

Thanks! that helped.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...