Dashboards & Visualizations

how to make loop in splunk query

carinahOliveira
Explorer

I have a query that returns multiple times and I need to step through this result doing a subtraction count between one and the other.

Example:
Time = time[0] - time[1]
Time = time[1] - time[2]

etc ....


My search looks like this:

 

<my search>
| eval Time=_time
| stats values(Time) as Time by UserName| eval reconnection=if(UserName == UserName, tonumber(mvindex(Time,1))-tonumber(mvindex(Time,0)), "falha")
| where reconnection>0 AND reconnection<600
| eval reconnection=tostring(reconnection, "duration")

1 Solution

carinahOliveira
Explorer

I managed to solve it and I'll leave the solution here in case anyone needs it.

As mentioned earlier, there is no way to create a loop, but we can create a range and use it to iterate

Here's how I did it:

---------------------
| eval i = mvrange(0,10)
| mvexpand i

----------------------

 

 

<my search>

| eval Time=_time
| stats values(Time) as Time by UserName

| eval i = mvrange(0,10)
| mvexpand i

| eval reconnection=if(UserName==UserName, tonumber(mvindex(Time,i+1))-tonumber(mvindex(Time,i)), "falha")
| where reconnection>0 AND reconnection<600

| eval reconnection=tostring(reconnection, "duration")

View solution in original post

0 Karma

carinahOliveira
Explorer

I managed to solve it and I'll leave the solution here in case anyone needs it.

As mentioned earlier, there is no way to create a loop, but we can create a range and use it to iterate

Here's how I did it:

---------------------
| eval i = mvrange(0,10)
| mvexpand i

----------------------

 

 

<my search>

| eval Time=_time
| stats values(Time) as Time by UserName

| eval i = mvrange(0,10)
| mvexpand i

| eval reconnection=if(UserName==UserName, tonumber(mvindex(Time,i+1))-tonumber(mvindex(Time,i)), "falha")
| where reconnection>0 AND reconnection<600

| eval reconnection=tostring(reconnection, "duration")

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Splunk doesn't have loops like programming languages.  The foreach and map commands let you iterate over fields or events, respectively, but those don't do what you describe.

The closest you can get is the streamstats command with the range function.  This command computes the difference between the current value of the 'time' field and the previous one.

| streamstats window=1 range(time) as Time

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...