Splunk Search

Data of a field in next row in another field of current row

sunilpanda023
Path Finder

![alt text][1]

The siuation is - I have sprint and their start date , I want the next sprint start date in same row and for last sprint current date.

Current Result:-
sprint sprint_startDate
Sprint-0 06-March-2017

Sprint-1 29-March-2017

Sprint-2 17-April-2017

Required Result:-
sprint sprint_startDate ** nextsprint_startDate**
Sprint-0 06-March-2017 29-March-2017
Sprint-1 29-March-2017 17-April-2017
Sprint-2 17-April-2017 now()

0 Karma
1 Solution

DalJeanis
Legend
| reverse 
| autoregress sprint_startDate as nextsprint_startDate p=1
| reverse
| fillnull value=now() nextsprint_startDate 

Updated to fill in the current date for "nextsprint_startDate" for the last sprint. Probably not the right specification, in my experience, but it was the request... 😉

View solution in original post

sunilpanda023
Path Finder

Thank you DalJeanis

I tried with this too and it worked and it has the step function with window to change the step in any case.

| sort - sprintstartDate
| streamstats last(sprintstartDate) as next_sprintstartDate window=1 current=f
| sort  sprintstartDate

| eval next_sprintstartDate=if(isnull(next_sprintstartDate),now()),next_sprintstartDate)
0 Karma

DalJeanis
Legend
| reverse 
| autoregress sprint_startDate as nextsprint_startDate p=1
| reverse
| fillnull value=now() nextsprint_startDate 

Updated to fill in the current date for "nextsprint_startDate" for the last sprint. Probably not the right specification, in my experience, but it was the request... 😉

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...