is it possible to use variables in splunk to count something? For example if a string match something the variable "X" increase by one.
Perhaps there is another way to solve my problem:
My actually search looks like this:
I'd like to have something like this:
This means every time "diff" is bigger than "0.3" the ID have to increase by one.
your base search giving _time,diff,Code | streamstats current=f window=1 first(diff) as prevDiff | eval ID=case(isnull(prevDiff),1,diff-prevDiff>0.3,1,1=1,0) | accum ID
thank you so much. Your answer was very helpful. But I did not need the streamstats command. To solve my problem I take this one:
my base search giving _time,diff,Code | eval ID=case(isnull(diff),1,diff>0.3,1,1=1,0) | accum ID
So every time "diff" is greater than 0.3 "ID" will increase by one. Your given code calculate the difference between the "diff" fields which I do not need in this example.
View solution in original post