Splunk Search

How to increment the field based on the previous value based on the condition?

Explorer

Dear Splunkers,

I want to increment the fields value based on Some conditions as like below.

Limit       |    Change
10           |        0
10           |        0
10           |        0
20           |        1
20           |        1
05           |        2
05           |        2
15           |        3
15           |        3

Like above, I need to increment the value from previous value whenever there is a change in the Limit Column.

Thank You.

1 Solution

Influencer

Try this

...| autoregress limit as limit_old | eval change=0 | autoregress change as change_old | eval change = if(limit=limit_old, change_old,change_old+1) | table limit change 

View solution in original post

Influencer

Try this

...| autoregress limit as limit_old | eval change=0 | autoregress change as change_old | eval change = if(limit=limit_old, change_old,change_old+1) | table limit change 

View solution in original post

Explorer

Hello, thank you for the solution, I am also struggling with the same problem for quite sometime.
given logic is not working when have a table with values changing between 0 and 1. I want to change the field value every time a even is fired

Limit Change ExpectedChange
1 0
1 0 0
2 1 1
2 0 1
1 1 2
2 1 3
1 1 4
2 1 5
1 1 6
2 1 7
1 1 8
2 1 9
2 0 9
2 0 9
2 0 9
2 0 9

I am using following code. Can you please help.

| sort localisation time
| streamstats range(
time) as Duration window=2
| eval Duration1 = Duration/60
| eval limit = if(Duration1 < 1,1,2)
| autoregress limit as limitold | eval change=0 | autoregress change as changeold | eval change = if(limit=limitold, changeold,change_old+1) | table limit change

0 Karma

Explorer

You may have solved this by now but i just had the same problem so I'll post this here for anyone else who needs it.

...| autoregress limit as limit_old | eval change=0 | autoregress change as change_old | eval change = if(limit=limit_old, change_old,change_old+1) | table limit change | streamstats count(eval(change==1)) as conecutive_change
0 Karma