Splunk Search

How to best use streamstats command with optional arguments, reset_after or reset_before?

MsherVin
New Member

Does anyone have an example of how to use:

reset_after="(" < eval-expression > ")"

and

reset_before="(" < eval-expression > ")" 

with streamstats?

For example, I would like to try something to the effects of:

_time , shift , count
11/1/16 5:11:00.000 PM, DAY, 1
11/1/16 5:12:00.000 PM, DAY, 2
11/1/16 5:13:00.000 PM, NIGHT, 1
11/1/16 5:14:00.000 PM, NIGHT, 2
11/1/16 5:15:00.000 PM, NIGHT, 1
11/1/16 5:16:00.000 PM, NIGHT, 2
11/1/16 5:17:00.000 PM, DAY, 1
11/1/16 5:18:00.000 PM, NIGHT, 3

where the value of eval-expression would be reset after 11/1/16 5:14:00.000 PM (in epoch format or else) in this case.

Thank you thank you!

Tags (2)
0 Karma

niketn
Legend

Double quotes in the evaluation expression within reset_before or reset_after should be escaped with backslash (\). Since you are switching by static time in this case you don't need by shift as a streamstats split field.

 base_search | eval Time=strftime(_time,"%m/%d/%y %H:%M:%S.%3N %p")  | streamstats count as shift reset_after="("match(Time,\"11/01/16 05:14:00.000 AM\")")"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

lquinn
Contributor

So I had a bit of a play around with this data set. I got part way to the answer. When I converted the timestamp to epoch it seemed to give the expected result using the following:

base_search | eval Time=_time | streamstats count by shift reset_on_change="Time=1478020440"

However when trying to use the _time field, it did not give the same result. I also had problems when using strings in general. Perhaps you can only use numbers?? Anyone else have a solution for use where the field value is a string?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...