Splunk Search

How to use Streamstats command with conditions added ?

zacksoft_wf
Contributor

my tablular output contains columns/fields like,
account_number | colour | team_name |  business_unit

I am getting the above output by stats aggregating BY 'account_number'.
Some of the events with the same account_number has null (colour,  team_name and  business_unit) values. So I used ,
| streamstats last(colour) as colour,
last(team_name ) as team_name ,
last(team_name ) as team_name .
to populate from the previous row values.

I want streamstats to populate the empty fields with the previous row value, "ONLY IF, the previous row "account_number" is same with the current row".  

The issue I am getting now is, lets say. I have three rows with account_number value 0001. and if 4th row has account_number is 0002 and has other three fields (colour,  team_name and  business_unit) empty, it is populating them with the previous 0001 account_number's value , which is incorrect. 

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust
Hi
have you already try "reset_on_change=true" ?
r. Ismo

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Hi
have you already try "reset_on_change=true" ?
r. Ismo
0 Karma

zacksoft_wf
Contributor

No, I haven't.

Is this the correct way of using it ?

| streamstats last(colour) as colour,
last(team_name ) as team_name ,
last(team_name ) as team_name  
reset_on_change=true

Also, do I have to use the BY clause here ?
BY <the field comparing which I want the reset to be applied, 'account_number' field>   ???

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Yes you should use "BY account_number" to reset those calculations when account number changed.
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

How much can you really learn in 3 minutes?

Observability can certainly be hard to understand – there's a lot of jargon and buzzwords and it seems to ...

Event Series: The Agentic SOC: Trust Before Autonomy

AI is fundamentally changing security operations, but true progress requires more than just automation—it ...

Free Professional Services for .conf26 Attendees

This year at .conf26, we are doing something a little different. We are bringing the best minds from ...