topic Re: how to make loop in splunk query in Dashboards & Visualizations

how to make loop in splunk query

carinahOliveira — Fri, 26 Nov 2021 15:17:27 GMT

I have a query that returns multiple times and I need to step through this result doing a subtraction count between one and the other.

Example:
Time = time[0] - time[1]
Time = time[1] - time[2]

etc ....

My search looks like this:

<my search>
| eval Time=_time
| stats values(Time) as Time by UserName| eval reconnection=if(UserName == UserName, tonumber(mvindex(Time,1))-tonumber(mvindex(Time,0)), "falha")
| where reconnection>0 AND reconnection<600
| eval reconnection=tostring(reconnection, "duration")

Re: how to make loop in splunk query

richgalloway — Fri, 26 Nov 2021 15:51:33 GMT

Splunk doesn't have loops like programming languages. The foreach and map commands let you iterate over fields or events, respectively, but those don't do what you describe.

The closest you can get is the streamstats command with the range function. This command computes the difference between the current value of the 'time' field and the previous one.

| streamstats window=1 range(time) as Time

Re: how to make loop in splunk query

carinahOliveira — Fri, 26 Nov 2021 18:31:59 GMT

I managed to solve it and I'll leave the solution here in case anyone needs it.

As mentioned earlier, there is no way to create a loop, but we can create a range and use it to iterate

Here's how I did it:

---------------------
| eval i = mvrange(0,10)
| mvexpand i

----------------------

| eval Time=_time
| stats values(Time) as Time by UserName

| eval i = mvrange(0,10)
| mvexpand i

| eval reconnection=if(UserName==UserName, tonumber(mvindex(Time,i+1))-tonumber(mvindex(Time,i)), "falha")
| where reconnection>0 AND reconnection<600

| eval reconnection=tostring(reconnection, "duration")