That's close, but it doesn't quite work, because I need an iterative process.
Imagine this set of events with one input and three calculated values per event:
A Inc= 2*A Dec=0 Total=T
B Inc= 2*B Dec=0.5*T Q=T+Inc-Dec
C Inc= 2*C Dec=0.5*Q R=Q+Inc-Dec
So I have a running total, but it is incremented and decremented by calculated values based on the prior step.
The problem I'm having is that both streamstats and eval run on the entire dataset at one time. However, what I need to do is run streamstats and eval alternately on ONE step at a time.
If I run the eval command for "Dec" before streamstats, it just returns zeros, because the fourth column isn't populated yet.
However, if I run the streamstats command to pull down the total first, it just returns zeros, because the eval command for the fourth column hasn't been run yet.
This is a situation where it would be immensely helpful to be able to run an eval command on just one event, and not the whole dataset, but I can't figure out how to do that.
... View more