Splunk Search

Data of a field in next row in another field of current row

sunilpanda023
Path Finder

![alt text][1]

The siuation is - I have sprint and their start date , I want the next sprint start date in same row and for last sprint current date.

Current Result:-
sprint sprint_startDate
Sprint-0 06-March-2017

Sprint-1 29-March-2017

Sprint-2 17-April-2017

Required Result:-
sprint sprint_startDate ** nextsprint_startDate**
Sprint-0 06-March-2017 29-March-2017
Sprint-1 29-March-2017 17-April-2017
Sprint-2 17-April-2017 now()

0 Karma
1 Solution

DalJeanis
Legend
| reverse 
| autoregress sprint_startDate as nextsprint_startDate p=1
| reverse
| fillnull value=now() nextsprint_startDate 

Updated to fill in the current date for "nextsprint_startDate" for the last sprint. Probably not the right specification, in my experience, but it was the request... 😉

View solution in original post

sunilpanda023
Path Finder

Thank you DalJeanis

I tried with this too and it worked and it has the step function with window to change the step in any case.

| sort - sprintstartDate
| streamstats last(sprintstartDate) as next_sprintstartDate window=1 current=f
| sort  sprintstartDate

| eval next_sprintstartDate=if(isnull(next_sprintstartDate),now()),next_sprintstartDate)
0 Karma

DalJeanis
Legend
| reverse 
| autoregress sprint_startDate as nextsprint_startDate p=1
| reverse
| fillnull value=now() nextsprint_startDate 

Updated to fill in the current date for "nextsprint_startDate" for the last sprint. Probably not the right specification, in my experience, but it was the request... 😉

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...