Splunk Search

How to use Streamstats command with conditions added ?

zacksoft_wf
Contributor

my tablular output contains columns/fields like,
account_number | colour | team_name |  business_unit

I am getting the above output by stats aggregating BY 'account_number'.
Some of the events with the same account_number has null (colour,  team_name and  business_unit) values. So I used ,
| streamstats last(colour) as colour,
last(team_name ) as team_name ,
last(team_name ) as team_name .
to populate from the previous row values.

I want streamstats to populate the empty fields with the previous row value, "ONLY IF, the previous row "account_number" is same with the current row".  

The issue I am getting now is, lets say. I have three rows with account_number value 0001. and if 4th row has account_number is 0002 and has other three fields (colour,  team_name and  business_unit) empty, it is populating them with the previous 0001 account_number's value , which is incorrect. 

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust
Hi
have you already try "reset_on_change=true" ?
r. Ismo

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Hi
have you already try "reset_on_change=true" ?
r. Ismo
0 Karma

zacksoft_wf
Contributor

No, I haven't.

Is this the correct way of using it ?

| streamstats last(colour) as colour,
last(team_name ) as team_name ,
last(team_name ) as team_name  
reset_on_change=true

Also, do I have to use the BY clause here ?
BY <the field comparing which I want the reset to be applied, 'account_number' field>   ???

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Yes you should use "BY account_number" to reset those calculations when account number changed.
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...

Deep insights, no barriers: Splunk Observability Cloud Free Edition

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...

Monitoring AI Agents with Splunk Observability Cloud

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...