Splunk Search

Data of a field in next row in another field of current row

sunilpanda023
Path Finder

![alt text][1]

The siuation is - I have sprint and their start date , I want the next sprint start date in same row and for last sprint current date.

Current Result:-
sprint sprint_startDate
Sprint-0 06-March-2017

Sprint-1 29-March-2017

Sprint-2 17-April-2017

Required Result:-
sprint sprint_startDate ** nextsprint_startDate**
Sprint-0 06-March-2017 29-March-2017
Sprint-1 29-March-2017 17-April-2017
Sprint-2 17-April-2017 now()

0 Karma
1 Solution

DalJeanis
Legend
| reverse 
| autoregress sprint_startDate as nextsprint_startDate p=1
| reverse
| fillnull value=now() nextsprint_startDate 

Updated to fill in the current date for "nextsprint_startDate" for the last sprint. Probably not the right specification, in my experience, but it was the request... 😉

View solution in original post

sunilpanda023
Path Finder

Thank you DalJeanis

I tried with this too and it worked and it has the step function with window to change the step in any case.

| sort - sprintstartDate
| streamstats last(sprintstartDate) as next_sprintstartDate window=1 current=f
| sort  sprintstartDate

| eval next_sprintstartDate=if(isnull(next_sprintstartDate),now()),next_sprintstartDate)
0 Karma

DalJeanis
Legend
| reverse 
| autoregress sprint_startDate as nextsprint_startDate p=1
| reverse
| fillnull value=now() nextsprint_startDate 

Updated to fill in the current date for "nextsprint_startDate" for the last sprint. Probably not the right specification, in my experience, but it was the request... 😉

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...