Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Data of a field in next row in another field of cu...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![alt text][1]
The siuation is - I have sprint and their start date , I want the next sprint start date in same row and for last sprint current date.
Current Result:-
sprint sprint_startDate
Sprint-0 06-March-2017
Sprint-1 29-March-2017
Sprint-2 17-April-2017
Required Result:-
sprint sprint_startDate ** nextsprint_startDate**
Sprint-0 06-March-2017 29-March-2017
Sprint-1 29-March-2017 17-April-2017
Sprint-2 17-April-2017 now()
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
| reverse
| autoregress sprint_startDate as nextsprint_startDate p=1
| reverse
| fillnull value=now() nextsprint_startDate
Updated to fill in the current date for "nextsprint_startDate" for the last sprint. Probably not the right specification, in my experience, but it was the request... 😉
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you DalJeanis
I tried with this too and it worked and it has the step function with window to change the step in any case.
| sort - sprintstartDate
| streamstats last(sprintstartDate) as next_sprintstartDate window=1 current=f
| sort sprintstartDate
| eval next_sprintstartDate=if(isnull(next_sprintstartDate),now()),next_sprintstartDate)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
| reverse
| autoregress sprint_startDate as nextsprint_startDate p=1
| reverse
| fillnull value=now() nextsprint_startDate
Updated to fill in the current date for "nextsprint_startDate" for the last sprint. Probably not the right specification, in my experience, but it was the request... 😉
Splunk Mobile: Your Brand-New Home Screen
Introducing Value Insights (Beta): Understand the Business Impact your organization ...
Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...
