https://community.splunk.com/t5/Splunk-Search/How-do-i-write-a-query-on-SPL-to-have-a-flag-when-next-value-of/m-p/141064#M39041 <P>Hi,</P> <UL> <LI>| delta <VALUE field=""> </VALUE></LI> </UL> <P>then you can make a eval with if statement. eval result= if(delta=0, 0, 1)</P> <P>if the delta value is 0 assign 0 every other value assign 1</P> <P>br<BR /> matthias</P> Wed, 13 Nov 2013 19:14:30 GMT Matthias_BY 2013-11-13T19:14:30Z https://community.splunk.com/t5/Splunk-Search/How-do-i-write-a-query-on-SPL-to-have-a-flag-when-next-value-of/m-p/141063#M39040 <P>How do i write a query on SPL to have a flag when next value on events is greater then the precedence value? </P> <P>Hereby an example and the expected Result , values are from 1 to 100 and results should be zero or one when next value is greater then precedence value</P> <PRE><CODE>&gt; event 1: value 1 [ Result:0] &gt; event 2: value 2 [ Result:1] &gt; event 3: value 2 [ Result:0] &gt; event 4: value 2 [ Result:0] &gt; event 5: value 3 [ Result:1] &gt; event 6: value 3 [ Result:0] &gt; event 7: value 1 [ Result:0] &gt; event 8: value 1 [ Result:0] &gt; event 9: value 2 [ Result:1] &gt; event 10:value 2 [ Result:0] </CODE></PRE> Wed, 13 Nov 2013 18:46:00 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-write-a-query-on-SPL-to-have-a-flag-when-next-value-of/m-p/141063#M39040 royimad 2013-11-13T18:46:00Z https://community.splunk.com/t5/Splunk-Search/How-do-i-write-a-query-on-SPL-to-have-a-flag-when-next-value-of/m-p/141064#M39041 <P>Hi,</P> <UL> <LI>| delta <VALUE field=""> </VALUE></LI> </UL> <P>then you can make a eval with if statement. eval result= if(delta=0, 0, 1)</P> <P>if the delta value is 0 assign 0 every other value assign 1</P> <P>br<BR /> matthias</P> Wed, 13 Nov 2013 19:14:30 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-write-a-query-on-SPL-to-have-a-flag-when-next-value-of/m-p/141064#M39041 Matthias_BY 2013-11-13T19:14:30Z