Splunk Search

How do I find a pattern in a field that contains 10 digit numbers that increase by 1?

milky88
New Member

I have a field called data. Example of what is in the data field.
1234567890
9999999999
7638278823
1234567891
8475627744
1234567892

I am trying to extract data from the data field that show numbers that increase by 1.
ONLY would need the following:
1234567890
1234567891
1234567892
Not really sure where to start. Any help would greatly be appreciated.

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi milky88,
try something like this example:

| makeresults | eval my_field=1234567890
| append [ | makeresults | eval my_field=9999999999 ]
| append [ | makeresults | eval my_field=7638278823 ]
| append [ | makeresults | eval my_field=1234567891 ]
| append [ | makeresults | eval my_field=8475627744 ]
| append [ | makeresults | eval my_field=1234567892 ]
| sort my_field
| delta my_field AS delta
| fillnull value=0 delta
| where delta<2
| table my_field

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...