topic Re: How to check if values are incremental by 1 for a specific category in Splunk Search

How to check if values are incremental by 1 for a specific category

Nikitha — Fri, 11 Sep 2020 08:28:46 GMT

If the above displayed data is the result for my stats command [stats values(Values) as Values by Category], how can I use the search to check if the values for each category are incremental by 1 and output the values that have been missed.

I want the result to look like this :

Re: How to check if values are incremental by 1 for a specific category

ITWhisperer — Fri, 11 Sep 2020 09:08:42 GMT

| makeresults | eval event="{\"Category\":\"Cat1\",\"Values\":[1,2,3,5,7]}\n{\"Category\":\"Cat2\",\"Values\":[6,8,9,10]}" | eval event=split(event,"\n") | mvexpand event | spath input=event | rename Values{} as Values | fields Category, Values | fields - _time | eval low=tonumber(mvindex(Values,0)) | eval high=tonumber(mvindex(Values,mvcount(Values)-1)) | eval expected=mvrange(low, high + 1) | eval missing=mvmap(expected,if(isnull(mvfind(Values,expected)),expected,NULL())) | fields Category, missing | rename missing as Values

Re: How to check if values are incremental by 1 for a specific category

thambisetty — Fri, 11 Sep 2020 09:16:16 GMT

It's possible to find before applying stats. after applying stats may be possible but it's not easy.

can you also confirm, if those values are in sequential with timestamp?

Re: How to check if values are incremental by 1 for a specific category

thambisetty — Fri, 11 Sep 2020 09:27:46 GMT

try below:

reference: https://community.splunk.com/t5/Splunk-Search/How-to-find-the-missing-number-sequence-from-a-table/m-p/433590

Re: How to check if values are incremental by 1 for a specific category

Naga2 — Thu, 07 Sep 2023 14:10:08 GMT

Hello @thambisetty ,

Can you able to explain each line usage if possible?

How can we build this same missing_number logic in if condition and throw an error if we miss any number in between.

In our case also the sequnce increase by one.

Each Doc_ID(AGDGYS8737vdhh = file_name like category mentioned in this post) has set of sequence_number increase one by one.If it not increase by one means then we came to conclusion like some number missed in between we can trigger alert then and there.