Splunk Search

Streamstats change state count

ips_mandar
Builder

Hi below is my sample data-

Date                       source                State
 29-05-20 01:00:00            abc                 On
 29-05-20 01:10:00            abc                 Off
 29-05-20 01:20:00            abc                 On
 29-05-20 01:30:00            abc                 On
 29-05-20 01:50:00            abc                 Off
 29-05-20 01:55:00            abc                 On

Here I want to calculate "Number of Times State Went from On to Off" and "Number of Times State Went from Off to On" using streamstats command.
In above case results will be-

source|date| "Number of Times State Went from On to Off" |"Number of Times State Went from Off to On"|"Number of RunSwitch ONs"|"Number of RunSwitch Offs"
    abc    |29-05-20    | 2          | 2           |4          |2

with help of @kamlesh_vaghela I am able to extract first two columns and now my new requirement is to add above four columns.
Ref-https://answers.splunk.com/answers/825891/streamstats-change-state-count.html
Note- I want above all these by each source.

Labels (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ips_mandar

For this requirement, I would like to suggest you below search.

YOUR_SEARCH | streamstats window=2 list(State) as S 
| eval Status=case(mvindex(S,0)="On" AND mvindex(S,1)="Off","Number of Times State Went from On to Off",mvindex(S,0)="Off" AND mvindex(S,1)="On","Number of Times State Went from Off to On")
| stats count(eval(State="On")) as "Number of RunSwitch ONs"  count(eval(State="Off")) as "Number of RunSwitch Offs" count(eval(Status="Number of Times State Went from On to Off")) as "Number of Times State Went from On to Off" count(eval(Status="Number of Times State Went from Off to On")) as "Number of Times State Went from Off to On"
| table "Number of Times State Went from On to Off" "Number of Times State Went from Off to On" "Number of RunSwitch ONs" "Number of RunSwitch Offs"

Sample Search:

| makeresults 
| eval _raw="Date,State
29-05-20 01:00:00,On
29-05-20 01:10:00,Off
29-05-20 01:20:00,On
29-05-20 01:30:00,On
29-05-20 01:50:00,Off
29-05-20 01:55:00,On" 
| multikv forceheader=1 
| table Date State 
| streamstats window=2 list(State) as S 
| eval Status=case(mvindex(S,0)="On" AND mvindex(S,1)="Off","Number of Times State Went from On to Off",mvindex(S,0)="Off" AND mvindex(S,1)="On","Number of Times State Went from Off to On")
| stats count(eval(State="On")) as "Number of RunSwitch ONs"  count(eval(State="Off")) as "Number of RunSwitch Offs" count(eval(Status="Number of Times State Went from On to Off")) as "Number of Times State Went from On to Off" count(eval(Status="Number of Times State Went from Off to On")) as "Number of Times State Went from Off to On"
| table "Number of Times State Went from On to Off" "Number of Times State Went from Off to On" "Number of RunSwitch ONs" "Number of RunSwitch Offs"

Thanks

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ips_mandar

For this requirement, I would like to suggest you below search.

YOUR_SEARCH | streamstats window=2 list(State) as S 
| eval Status=case(mvindex(S,0)="On" AND mvindex(S,1)="Off","Number of Times State Went from On to Off",mvindex(S,0)="Off" AND mvindex(S,1)="On","Number of Times State Went from Off to On")
| stats count(eval(State="On")) as "Number of RunSwitch ONs"  count(eval(State="Off")) as "Number of RunSwitch Offs" count(eval(Status="Number of Times State Went from On to Off")) as "Number of Times State Went from On to Off" count(eval(Status="Number of Times State Went from Off to On")) as "Number of Times State Went from Off to On"
| table "Number of Times State Went from On to Off" "Number of Times State Went from Off to On" "Number of RunSwitch ONs" "Number of RunSwitch Offs"

Sample Search:

| makeresults 
| eval _raw="Date,State
29-05-20 01:00:00,On
29-05-20 01:10:00,Off
29-05-20 01:20:00,On
29-05-20 01:30:00,On
29-05-20 01:50:00,Off
29-05-20 01:55:00,On" 
| multikv forceheader=1 
| table Date State 
| streamstats window=2 list(State) as S 
| eval Status=case(mvindex(S,0)="On" AND mvindex(S,1)="Off","Number of Times State Went from On to Off",mvindex(S,0)="Off" AND mvindex(S,1)="On","Number of Times State Went from Off to On")
| stats count(eval(State="On")) as "Number of RunSwitch ONs"  count(eval(State="Off")) as "Number of RunSwitch Offs" count(eval(Status="Number of Times State Went from On to Off")) as "Number of Times State Went from On to Off" count(eval(Status="Number of Times State Went from Off to On")) as "Number of Times State Went from Off to On"
| table "Number of Times State Went from On to Off" "Number of Times State Went from Off to On" "Number of RunSwitch ONs" "Number of RunSwitch Offs"

Thanks

0 Karma

ips_mandar
Builder

Thank you! your query search results taking less time than other hence accepting your answer.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@ips_mandar ,

Adding to the previous search, try

"Your search"
| streamstats window=2 list(State) as S | eval Status=case(mvindex(S,0)="On" AND mvindex(S,1)="Off","Number of Times State Went from On to Off",mvindex(S,0)="Off" AND mvindex(S,1)="On","Number of Times State Went from Off to On")
 |eventstats count(eval(State=="On")) as On,count(eval(State=="Off")) as Off
| stats first(On) as "Number of RunSwitch ONs",first(Off) as "Number of RunSwitch Offs",count by Status
| eval {Status}=count
| fields - Status,count
| stats values(*) as *
Happy Splunking!

ips_mandar
Builder

Thank you

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...