Splunk Search

Getting the occurrence count

moinyuso96
Path Finder

Right now I have a table with fields: DateTime, TestFeatureName and Status.

How can I create another field "Occurrence" that can count the number of occurrence for each Start-Complete as below?

DateTimeTestFeatureNameStatusOccurrence
10.00 pmABCStart1
10.20 pmABCComplete1
10.40 pmABCStart2
10.45 pmABCComplete2
11.10 pmDEFStart3
11.30 pmDEFComplete3
Labels (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@moinyuso96 

Can you please try this?

YOUR_SEARCH
| sort _time
| transaction startswith=Status="Start" endswith=Status="Complete" | eval Occurrence=1 | accum Occurrence
| eval t=mvzip(DateTime,Status) | mvexpand t | eval DateTime=mvindex(split(t,","),0),Status=mvindex(split(t,","),1) | fields - t
| table DateTime TestFeatureName Status Occurrence

 

My Sample Search :

| makeresults | eval _raw="DateTime	TestFeatureName	Status
10.00 pm	ABC	Start
10.20 pm	ABC	Complete
10.40 pm	ABC	Start
10.45 pm	ABC	Complete
11.10 pm	DEF	Start
11.30 pm	DEF	Complete"| multikv forceheader=1
| eval t = -100 | accum t | eval _time = _time + t
| fields _time DateTime TestFeatureName Status
| rename comment as "Upto now is sample data only"
| sort _time
| transaction startswith=Status="Start" endswith=Status="Complete" | eval Occurrence=1 | accum Occurrence
| eval t=mvzip(DateTime,Status) | mvexpand t | eval DateTime=mvindex(split(t,","),0),Status=mvindex(split(t,","),1) | fields - t
| table DateTime TestFeatureName Status Occurrence

 

 

Screenshot 2021-06-16 at 2.52.37 PM.png

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. 

 

 

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@moinyuso96 

Can you please try this?

YOUR_SEARCH
| sort _time
| transaction startswith=Status="Start" endswith=Status="Complete" | eval Occurrence=1 | accum Occurrence
| eval t=mvzip(DateTime,Status) | mvexpand t | eval DateTime=mvindex(split(t,","),0),Status=mvindex(split(t,","),1) | fields - t
| table DateTime TestFeatureName Status Occurrence

 

My Sample Search :

| makeresults | eval _raw="DateTime	TestFeatureName	Status
10.00 pm	ABC	Start
10.20 pm	ABC	Complete
10.40 pm	ABC	Start
10.45 pm	ABC	Complete
11.10 pm	DEF	Start
11.30 pm	DEF	Complete"| multikv forceheader=1
| eval t = -100 | accum t | eval _time = _time + t
| fields _time DateTime TestFeatureName Status
| rename comment as "Upto now is sample data only"
| sort _time
| transaction startswith=Status="Start" endswith=Status="Complete" | eval Occurrence=1 | accum Occurrence
| eval t=mvzip(DateTime,Status) | mvexpand t | eval DateTime=mvindex(split(t,","),0),Status=mvindex(split(t,","),1) | fields - t
| table DateTime TestFeatureName Status Occurrence

 

 

Screenshot 2021-06-16 at 2.52.37 PM.png

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. 

 

 

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...