I have below events-
value=1
value=3
value=5
value=0
value=4
value=5
value=6
value=0
value=1
Here I want to pick last value before value=0 and at end value if there is no zero value at end like in above case I want value=5 and value=6 and value=1
and add these value to get result as value=12
Kindly guide me to achieve this.
In script it can be done by storing variable and at end adding all. How this can be done in splunk.
Thanks.
You can try this,
| makeresults
| eval value="1,3,5,0,4,5,6,0,1"
| makemv delim="," value
| mvexpand value
| fields - _time
| streamstats current=f window=1 last(value) as break
| append
[| makeresults
| eval value="1,3,5,0,4,5,6,0,1"
| makemv delim="," value
| mvexpand value
| fields - _time
| stats last(value) as final]
| fillnull value=0
| search value=0
| eval sum=break+final
| stats sum(sum) as sum
In your case, it will be
`your query`
| streamstats current=f window=1 last(value) as break
| append
[| `your query`
| stats last(value) as final]
| fillnull value=0
| search value=0
| eval sum=break+final
| stats sum(sum) as sum
You can try this,
| makeresults
| eval value="1,3,5,0,4,5,6,0,1"
| makemv delim="," value
| mvexpand value
| fields - _time
| streamstats current=f window=1 last(value) as break
| append
[| makeresults
| eval value="1,3,5,0,4,5,6,0,1"
| makemv delim="," value
| mvexpand value
| fields - _time
| stats last(value) as final]
| fillnull value=0
| search value=0
| eval sum=break+final
| stats sum(sum) as sum
In your case, it will be
`your query`
| streamstats current=f window=1 last(value) as break
| append
[| `your query`
| stats last(value) as final]
| fillnull value=0
| search value=0
| eval sum=break+final
| stats sum(sum) as sum