topic Re: How do I detect a gap in a sequence of items? in Splunk Search

How do I detect a gap in a sequence of items?

raoul — Tue, 26 Apr 2011 14:59:54 GMT

I have a number of events reaching Splunk. Each event has an ID which is a simple sequential number.

Is there a way (ideally a Splunk query) of detecting gaps in the sequence?

Re: How do I detect a gap in a sequence of items?

LukeMurphey — Tue, 26 Apr 2011 15:44:59 GMT

Splunk's IT Data Signing feature allows you to find gaps in the data. IT data signing will:

...displays information as to whether
the block of IT data has gaps, has
been tampered with, or is valid (no
gaps or tampering).

Re: How do I detect a gap in a sequence of items?

raoul — Tue, 26 Apr 2011 15:49:26 GMT

In the end I found that the following worked reasonably well:

sourcetype=XXX | sort id_field | delta id_field as id_diff | search id_diff>1 | table id_field, id_diff

Re: How do I detect a gap in a sequence of items?

sideview — Tue, 26 Apr 2011 17:14:33 GMT

the 'gaps' as meant by the data signing stuff are pretty different -- there it means some data destined for the indexer never made it there, perhaps through malicious activities. Raoul is just looking for gaps in a numeric sequence.