How to search records sequentially?

[disillusioned]

I have a search: index=lab-testresults sourcetype=lab-testresults type=testCase
and inside of the testCase I have a field called success, that tells me if the test passed or failed.
What I want to do is count the number of failures backwards from the most recent record until a record states that the testcase passed. (this is to get how many days in a row the test has failed).

Note: The test can be run multiple times a day, if it has failed all the times in a day that is 1 day failed. But if it has passed at least once, then it returns the number of days failed. If that makes sense.

How can I count the results in order to give me a number of days failed since the last time the test passed

[woodcock]

Like this:

index="lab-testresults" AND sourcetype="lab-testresults" AND type="testCase"
| reverse
| streamstats count(eval(success="SomeYesValueHere")) AS successID BY host and or other fields here
| stats min(_time) AS _time count AS failures BY successID host and or other fields here
| eval count = count - 1

[gfreitas]

Hi,
I believe you can use the command transaction to achieve that.
Using transaction you need to define the boundaries of an event (with startswith and endswith) and it will give you both the number of events in each transaction and how much time between the event start and the end of the event.
More information on that command can be found here: https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Transaction