Splunk Search

## How do I group events based on contiguous runs of field value?

Contributor

I would like something like a `stats` command that groups events only if they form a contiguous run of a particular field. Suppose I have a sequence of events that have a field called 'name' that appears in the following time-ordered sequence: A,A,A,A,B,C,B,Y,Y,Y,A,A,A,B,B,B. I would like to do something like:
| stats-like-command count, min(_time), max(_time) by name

This should produce something like:
A, 4, time1, time2
B, 1, time3, time4
C, 1, time5, time6
B, 1, time7, time8
Y, 3, time9, time10
A, 3, time11, time12
B, 3, time13, time14

It shouldn't matter how much time is between the events, I just want to collapse based on "runs" within the sequence of events.

Tags (2)
1 Solution
Contributor

I think I figured it out.

``````| streamstats count, min(_time) as min_time, max(_time) as max_time BY name reset_on_change=true
| eventstats max(count) as max_count by max_time, name
| where count=max_count
| convert ctime(*_time)
| table name, count, min_time, max_time
``````

For the Karma, feel free to paste this into the answer or provide a better way - Thanks.

Contributor

I think I figured it out.

``````| streamstats count, min(_time) as min_time, max(_time) as max_time BY name reset_on_change=true
| eventstats max(count) as max_count by max_time, name
| where count=max_count
| convert ctime(*_time)
| table name, count, min_time, max_time
``````

For the Karma, feel free to paste this into the answer or provide a better way - Thanks.

Contributor

Actually, this occasionally returns multiple consecutive results with the same name. Could it be that the eventstats is grabbing partial results from the streamstats command before "max_time" is fully resolved?

Get Updates on the Splunk Community!

#### Optimize Cloud Monitoring

TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

#### What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

#### Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...