Splunk Search

Streamstats change state count

ips_mandar
Builder

Hi below is my sample data-

Date State
29-05-20 01:00:00  On
29-05-20 01:10:00  Off
29-05-20 01:20:00  On
29-05-20 01:30:00  On
29-05-20 01:50:00  Off
29-05-20 01:55:00  On

Here I want to calculate "Number of Times State Went from On to Off" and "Number of Times State Went from Off to On" using streamstats command.
In above case results will be-

"Number of Times State Went from On to Off" |"Number of Times State Went from Off to On"
    2                                                      2
Labels (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ips_mandar
Can you please try this?

YOUR_SEARCH | streamstats window=2 list(State) as S | eval Status=case(mvindex(S,0)="On" AND mvindex(S,1)="Off","Number of Times State Went from On to Off",mvindex(S,0)="Off" AND mvindex(S,1)="On","Number of Times State Went from Off to On") | stats count by Status | transpose header_field=Status | fields - column

My Sample Search:

| makeresults | eval _raw="Date,State
29-05-20 01:00:00,On
29-05-20 01:10:00,Off
29-05-20 01:20:00,On
29-05-20 01:30:00,On
29-05-20 01:50:00,Off
29-05-20 01:55:00,On" | multikv forceheader=1 | table Date State | streamstats window=2 list(State) as S | eval Status=case(mvindex(S,0)="On" AND mvindex(S,1)="Off","Number of Times State Went from On to Off",mvindex(S,0)="Off" AND mvindex(S,1)="On","Number of Times State Went from Off to On") | stats count by Status | transpose header_field=Status | fields - column

Thanks

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ips_mandar
Can you please try this?

YOUR_SEARCH | streamstats window=2 list(State) as S | eval Status=case(mvindex(S,0)="On" AND mvindex(S,1)="Off","Number of Times State Went from On to Off",mvindex(S,0)="Off" AND mvindex(S,1)="On","Number of Times State Went from Off to On") | stats count by Status | transpose header_field=Status | fields - column

My Sample Search:

| makeresults | eval _raw="Date,State
29-05-20 01:00:00,On
29-05-20 01:10:00,Off
29-05-20 01:20:00,On
29-05-20 01:30:00,On
29-05-20 01:50:00,Off
29-05-20 01:55:00,On" | multikv forceheader=1 | table Date State | streamstats window=2 list(State) as S | eval Status=case(mvindex(S,0)="On" AND mvindex(S,1)="Off","Number of Times State Went from On to Off",mvindex(S,0)="Off" AND mvindex(S,1)="On","Number of Times State Went from Off to On") | stats count by Status | transpose header_field=Status | fields - column

Thanks

View solution in original post

0 Karma

ips_mandar
Builder

Looks good! thank you.
If I observed any issue I will revert back. thanks again.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.