Splunk Search

How to use Streamstats command with conditions added ?

zacksoft_wf
Contributor

my tablular output contains columns/fields like,
account_number | colour | team_name |  business_unit

I am getting the above output by stats aggregating BY 'account_number'.
Some of the events with the same account_number has null (colour,  team_name and  business_unit) values. So I used ,
| streamstats last(colour) as colour,
last(team_name ) as team_name ,
last(team_name ) as team_name .
to populate from the previous row values.

I want streamstats to populate the empty fields with the previous row value, "ONLY IF, the previous row "account_number" is same with the current row".  

The issue I am getting now is, lets say. I have three rows with account_number value 0001. and if 4th row has account_number is 0002 and has other three fields (colour,  team_name and  business_unit) empty, it is populating them with the previous 0001 account_number's value , which is incorrect. 

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust
Hi
have you already try "reset_on_change=true" ?
r. Ismo

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Hi
have you already try "reset_on_change=true" ?
r. Ismo
0 Karma

zacksoft_wf
Contributor

No, I haven't.

Is this the correct way of using it ?

| streamstats last(colour) as colour,
last(team_name ) as team_name ,
last(team_name ) as team_name  
reset_on_change=true

Also, do I have to use the BY clause here ?
BY <the field comparing which I want the reset to be applied, 'account_number' field>   ???

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Yes you should use "BY account_number" to reset those calculations when account number changed.
0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...