Can you give more examples to this? I can't see how you would get to 7 based on that data - maybe I'm missing something?
because i want to count the sequence of zeroes the sequence goes like this:
the result : 3,4,5,6,7,-, 1,- ,-,1,2
the zeros at the start continues the zeroes at the end
each value is in a different row same column
I used the data you supplied in your example to populate a little table with a single row/field called
digit. If we didn't have to account for wrapping around the end of the list (the way you get to 7 in your example), it would be really straightforward. But here's a code snippet that achieves what you laid out:
| makeresults | eval digit="0,0,0,0,0,1,0,1,1,0,0" | makemv delim="," digit | mvexpand digit | fields - _time | streamstats count BY digit reset_on_change=true | eventstats first(digit) AS first_digit, last(digit) AS last_digit | eventstats max(count) AS max_count BY digit | eventstats last(count) AS final_count | eval total_count=if(first_digit=last_digit AND first_digit=digit, max_count+final_count, max_count) | fields digit, total_count
You can adjust it for other digit lists by adjusting the second line - or customize it to match your data source by editing/removing the first five lines.