Splunk Search

How to combine events with counting?

rendie
Path Finder

Hi folks,

Just a quick question. For example, a have a dataset

_timefield_xfield_y
14:0100
14:0201
14:0302
14:0413
14:0510
14:0600
14:0711
14:0810

 

If describe this logic in text: field_x is a random number 0 or 1. field_y is how many 0 was in previous events for field_x.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@rendie 

Can you please try this?

YOUR_SEARCH | sort _time | table _time field_x 
| autoregress field_x as pre p=1 | eval A=if(pre=0,1,null()) | accum A | streamstats list(A) as Z | eval AA = if(isnull(A) and mvcount(Z)>0,mvcount(Z),null()) | filldown AA | fillnull value="0" AA | eval field_y=A-AA
| table _time field_x field_y

 

My Sample Search :

| makeresults 
| eval _raw="_time	field_x	
14:01	0	0
14:02	0	1
14:03	0	2
14:04	1	3
14:05	1	0
14:06	0	0
14:07	0	1
14:08	1	0
14:09	0	0
14:10	1	0
14:11	0	0
14:12	0	0
14:13	0	0
14:14	0	0
14:15	1	0
14:16	0	0
14:17	0	0
14:18	1	0
" 
| multikv forceheader=1 
| eval t = 100 | accum t | eval _time = _time + t | sort _time | table _time field_x 
| autoregress field_x as pre p=1 | eval A=if(pre=0,1,null()) | accum A | streamstats list(A) as Z | eval AA = if(isnull(A) and mvcount(Z)>0,mvcount(Z),null()) | filldown AA | fillnull value="0" AA | eval field_y=A-AA
| table _time field_x field_y

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma

rendie
Path Finder

I'm sorry if my question was not complete. The fact is that initially, I do not have an X field, I create it using | eval field_x = if(fieldValue >= fieldThreshold, 1, 0)

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I changed field_x to As and Bs to show that non-numerics can be dealt with, you just need to compare to one of the values. I recreated field_y and field_z so you can see the process matches your requirement.

| makeresults
| eval _raw="_time	field_x	field_y
14:01	A	0
14:02	A	1
14:03	A	2
14:04	B	3
14:05	B	0
14:06	A	0
14:07	B	1
14:08	B	0"
| multikv forceheader=1
| fields - _* linecount
| streamstats window=1 current=f values(field_x) as previous
| eval previous_match=if(previous="A",1,0)
| streamstats window=1 current=f values(previous_match) as previous
| eval groupstart=if(previous_match=1 AND previous=0,1,0)
| streamstats sum(groupstart) as group
| eval group=if(previous_match=1,group,null)
| streamstats sum(previous_match) as field_z by group
| fillnull value=0 field_z

 

0 Karma

rendie
Path Finder

I'm sorry if my question was not complete. The fact is that initially, I do not have an X field, I create it using | eval field_x = if(fieldValue >= fieldThreshold, 1, 0).

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...