Getting the occurrence count

[moinyuso96]

Right now I have a table with fields: DateTime, TestFeatureName and Status.

How can I create another field "Occurrence" that can count the number of occurrence for each Start-Complete as below?

DateTime	TestFeatureName	Status	Occurrence
10.00 pm	ABC	Start	1
10.20 pm	ABC	Complete	1
10.40 pm	ABC	Start	2
10.45 pm	ABC	Complete	2
11.10 pm	DEF	Start	3
11.30 pm	DEF	Complete	3

[kamlesh_vaghela · Accepted solution]

@moinyuso96 

Can you please try this?

YOUR_SEARCH
| sort _time
| transaction startswith=Status="Start" endswith=Status="Complete" | eval Occurrence=1 | accum Occurrence
| eval t=mvzip(DateTime,Status) | mvexpand t | eval DateTime=mvindex(split(t,","),0),Status=mvindex(split(t,","),1) | fields - t
| table DateTime TestFeatureName Status Occurrence

My Sample Search :

| makeresults | eval _raw="DateTime	TestFeatureName	Status
10.00 pm	ABC	Start
10.20 pm	ABC	Complete
10.40 pm	ABC	Start
10.45 pm	ABC	Complete
11.10 pm	DEF	Start
11.30 pm	DEF	Complete"| multikv forceheader=1
| eval t = -100 | accum t | eval _time = _time + t
| fields _time DateTime TestFeatureName Status
| rename comment as "Upto now is sample data only"
| sort _time
| transaction startswith=Status="Start" endswith=Status="Complete" | eval Occurrence=1 | accum Occurrence
| eval t=mvzip(DateTime,Status) | mvexpand t | eval DateTime=mvindex(split(t,","),0),Status=mvindex(split(t,","),1) | fields - t
| table DateTime TestFeatureName Status Occurrence

Screenshot 2021-06-16 at 2.52.37 PM.png

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.