Splunk Search

How do I create a new column with incremental change based on another column?

KChaudhary
Explorer

Hello everyone, I am new to Splunk world and stuck with a query. Can you please help me find the solution for following problem.
I am trying to create a new column with a value which is increased by 1, if there is any change in limit column.

Here is the code that I tried :-

| sort localisation _time 
| streamstats range(_time) as Duration window=2 
| eval Duration1 = Duration/60 
| eval limit = if(Duration1 < 1,1,2) 
| autoregress limit as limit_old | eval change=0 | autoregress change as change_old | eval change = if(limit=limit_old, change_old,change_old+1) | table limit change

"Changes i get" is the column which is getting populated and "Expected changes" is what i am looking for. Every time the value in limit column changes, i want the column to increase values by 1 or else stay the same.

I tried the answer from this Post but its is not working for me

Limit   Change I get    ExpectedChange
1       0
1   0   0
2   1   1
2   0   1
1   1   2
2   1   3
1   1   4
2   1   5
1   1   6
2   1   7
1   1   8
2   1   9
2   0   9
2   0   9
2   0   9
2   0   9

Thank you in advance.

1 Solution

poete
Builder

Hello @KChaudhary,

here is the answer:

| makeresults
| eval sample="1,1,2,2,1,2,1,2,1,2,1,2,2,2,2,2"
| makemv delim="," sample
| mvexpand sample
| delta sample as diff
| eval diff=abs(diff)
| fillnull diff 
| accum diff as cum

View solution in original post

poete
Builder

Hello @KChaudhary,

here is the answer:

| makeresults
| eval sample="1,1,2,2,1,2,1,2,1,2,1,2,2,2,2,2"
| makemv delim="," sample
| mvexpand sample
| delta sample as diff
| eval diff=abs(diff)
| fillnull diff 
| accum diff as cum

KChaudhary
Explorer

Thank you very much. Its very neat. I am little worried about if the sample is not sequential as shown above and is something like 1,1,2,4,4,4,8,8,9,9,9,6,1,2, then difference could make it little more tricky.

with best regards
karan

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...