topic search sequential numbers in Splunk Search

search sequential numbers

fizzletwist — Thu, 24 Jan 2013 14:49:12 GMT

How can I search in Splunk to find events which contain sequential numbers in a given field?

Re: search sequential numbers

yannK — Thu, 24 Jan 2013 15:29:22 GMT

interesting tags.

Re: search sequential numbers

mloven_splunk — Thu, 24 Jan 2013 15:33:05 GMT

heh... boobs...

Re: search sequential numbers

kristian_kolb — Thu, 24 Jan 2013 16:05:38 GMT

Well, it depends on whether you want to sort your boobs..er..numbers at search time (sequentially), which could be accomplished with the sort command, e.g.;

your search | table _time boobs | sort boobs

If you want to ensure that you have sequential boobs without sorting, i.e. you want to know that they're in sequence from the start, you should have a look at the delta command, which will show the difference between the current and previous value. Thus it should be a numerical value.

your search | table _time boobs | delta boobs

_time          boobs     delta(boobs)
2013-01-01     32        
2013-01-02     33        1
2013-01-03     34        1
2013-01-04     35        1
2013-01-05     30        -5

Hope this helps,

Re: search sequential numbers

Rob — Thu, 24 Jan 2013 18:33:04 GMT

Nice tag, I think this splunk answer is now near the top of google search results

Re: search sequential numbers

jonuwz — Thu, 24 Jan 2013 18:33:18 GMT

is 1 number in a field, and sequential across events
or
sequential numbers in a field in 1 event ?