topic Re: stats/streamstats to display only last 2 result/row in Splunk Search

stats/streamstats to display only last 2 result/row

yuming1127 — Mon, 17 May 2021 03:52:29 GMT

Hi, i'm looking for a solution which only show the last and last-1 result using stats or streamstats function. Aim is to only display something like max(row) and max(row)-1

my search...

| stats values(product_tag*) as product_tag* values(*) as * by product,color,product_tag

outcome

product	color	product_tag	description
phone	red	abc_1	blabla1
phone	red	abc_2	blabla2
phone	red	abc_3	blabla3
phone	red	abc_4	blabla4

desired outcome

product	color	product_tag	description
phone	red	abc_3	blabla3
phone	red	abc_4	blabla4

product	color	product_tag	description
phone	red	abc_4	blabla4
phone	red	abc_3	blabla3

Re: stats/streamstats to display only last 2 result/row

kamlesh_vaghela — Mon, 17 May 2021 04:29:41 GMT

@yuming1127

try this.

YOUR_SEARCH | eval a=1 | accum a | eventstats max(a) as mx | where a=mx OR a=mx-1

Sample:

Thanks
KV
▄︻̷̿┻̿═━一

If this reply helps you, an upvote would be appreciated.

Re: stats/streamstats to display only last 2 result/row

yuming1127 — Mon, 17 May 2021 05:13:33 GMT

Great one KV,

one more addition question, how do i display the product_tag i search and the one previous of it.

For example:

my search...

| stats values(product_tag*) as product_tag* values(*) as * by product,color,product_tag

| search product_tag=abc_3

Outcome

product	color	product_tag	description
phone	red	abc_3	blabla3

Desired outcome

t	color	product_tag	description
phone	red	abc_2	blabla2
phone	red	abc_3	blabla3

really appreciate your help.

Re: stats/streamstats to display only last 2 result/row

kamlesh_vaghela — Mon, 17 May 2021 05:27:24 GMT

@yuming1127

For your search product_tag scenario try this.

Sample Search:

| makeresults | eval _raw="product color product_tag description phone red abc_1 blabla1 phone red abc_2 blabla2 phone red abc_3 blabla3 phone red abc_4 blabla4" | multikv forceheader=1 | table product color product_tag description | eval a=1 , search_product_tag="abc_3" | accum a | eventstats max(eval(if(search_product_tag==product_tag,a,null()))) as mx | where a=mx OR a=mx-1 | table product color product_tag description

Thanks
KV
▄︻̷̿┻̿═━一

If this reply helps you, an upvote would be appreciated.