Splunk Search

Create a new field with cumulative count of a unique ID

keithyap
Path Finder

IS there a way I can create a new field with a cumulative count of a unique ID?

For example, currently i have created a transaction which groups events together as "trips", however I would like to give each trip a number.

below is an example of what I am trying to acheive:
initially after using the transaction, the events will look like below. Each transaction event will have a unique vehicle ID, duration of trip and distance travelled.

vehID,Duration,Distance
1,30,40
1,20,30
2,30,40
3,20,30
3,40,50
3,50,60

I would like to add a cumulative count to act as a Trip Number.
vehID,Duration,Distance,tripNo
1,30,40,1
1,20,30,2
2,30,40,1
3,20,30,1
3,40,50,2
3,50,60,3

Could anyone advise how I could achieve the above?

Thanks!

0 Karma
1 Solution

aholzer
Motivator

Use streamstats command:

<your_search> | streamstats count AS tripNo by vehID

Hope this helps

View solution in original post

aholzer
Motivator

Use streamstats command:

<your_search> | streamstats count AS tripNo by vehID

Hope this helps

keithyap
Path Finder

Thanks! that helped.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...