Splunk Search

How handle time-based join with streamstats

kwalking
New Member

I have 2 sets of events, 1 for registration events, and 1 for host state events. There is a common field between the 2 sets of events which is the host. In the individual registration events, I need to know what the last known state for the host is so I can keep a running total of the number of registrations that have occurred. For certain states, the count should get reset.

For the last part, I know I'll need to create a field using eval to say what the increment/decrement value for the total is and then do a streamstats based upon the host name and state but correlating those values into the registration events has proven complicated.

Any thoughts as to how to do this?

Tags (3)
0 Karma

woodcock
Esteemed Legend

This should get you started:

sourcetype=registration OR sourcetype=status | eventstats latest(state) AS finalState BY host | streamstats current=t last(state) AS currentState by host | stats count(eval(sourcetype=registration AND currentState="RUNNING")) by host
0 Karma

kwalking
New Member

Rather, not just should certain states reset the count, but the registrations should only be counted while the host is in the 'RUNNING' state.

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...