Splunk Search

Getting the occurrence count

moinyuso96
Path Finder

Right now I have a table with fields: DateTime, TestFeatureName and Status.

How can I create another field "Occurrence" that can count the number of occurrence for each Start-Complete as below?

DateTimeTestFeatureNameStatusOccurrence
10.00 pmABCStart1
10.20 pmABCComplete1
10.40 pmABCStart2
10.45 pmABCComplete2
11.10 pmDEFStart3
11.30 pmDEFComplete3
Labels (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@moinyuso96 

Can you please try this?

YOUR_SEARCH
| sort _time
| transaction startswith=Status="Start" endswith=Status="Complete" | eval Occurrence=1 | accum Occurrence
| eval t=mvzip(DateTime,Status) | mvexpand t | eval DateTime=mvindex(split(t,","),0),Status=mvindex(split(t,","),1) | fields - t
| table DateTime TestFeatureName Status Occurrence

 

My Sample Search :

| makeresults | eval _raw="DateTime	TestFeatureName	Status
10.00 pm	ABC	Start
10.20 pm	ABC	Complete
10.40 pm	ABC	Start
10.45 pm	ABC	Complete
11.10 pm	DEF	Start
11.30 pm	DEF	Complete"| multikv forceheader=1
| eval t = -100 | accum t | eval _time = _time + t
| fields _time DateTime TestFeatureName Status
| rename comment as "Upto now is sample data only"
| sort _time
| transaction startswith=Status="Start" endswith=Status="Complete" | eval Occurrence=1 | accum Occurrence
| eval t=mvzip(DateTime,Status) | mvexpand t | eval DateTime=mvindex(split(t,","),0),Status=mvindex(split(t,","),1) | fields - t
| table DateTime TestFeatureName Status Occurrence

 

 

Screenshot 2021-06-16 at 2.52.37 PM.png

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. 

 

 

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@moinyuso96 

Can you please try this?

YOUR_SEARCH
| sort _time
| transaction startswith=Status="Start" endswith=Status="Complete" | eval Occurrence=1 | accum Occurrence
| eval t=mvzip(DateTime,Status) | mvexpand t | eval DateTime=mvindex(split(t,","),0),Status=mvindex(split(t,","),1) | fields - t
| table DateTime TestFeatureName Status Occurrence

 

My Sample Search :

| makeresults | eval _raw="DateTime	TestFeatureName	Status
10.00 pm	ABC	Start
10.20 pm	ABC	Complete
10.40 pm	ABC	Start
10.45 pm	ABC	Complete
11.10 pm	DEF	Start
11.30 pm	DEF	Complete"| multikv forceheader=1
| eval t = -100 | accum t | eval _time = _time + t
| fields _time DateTime TestFeatureName Status
| rename comment as "Upto now is sample data only"
| sort _time
| transaction startswith=Status="Start" endswith=Status="Complete" | eval Occurrence=1 | accum Occurrence
| eval t=mvzip(DateTime,Status) | mvexpand t | eval DateTime=mvindex(split(t,","),0),Status=mvindex(split(t,","),1) | fields - t
| table DateTime TestFeatureName Status Occurrence

 

 

Screenshot 2021-06-16 at 2.52.37 PM.png

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. 

 

 

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...