Dashboards & Visualizations

how to make loop in splunk query

carinahOliveira
Explorer

I have a query that returns multiple times and I need to step through this result doing a subtraction count between one and the other.

Example:
Time = time[0] - time[1]
Time = time[1] - time[2]

etc ....


My search looks like this:

 

<my search>
| eval Time=_time
| stats values(Time) as Time by UserName| eval reconnection=if(UserName == UserName, tonumber(mvindex(Time,1))-tonumber(mvindex(Time,0)), "falha")
| where reconnection>0 AND reconnection<600
| eval reconnection=tostring(reconnection, "duration")

1 Solution

carinahOliveira
Explorer

I managed to solve it and I'll leave the solution here in case anyone needs it.

As mentioned earlier, there is no way to create a loop, but we can create a range and use it to iterate

Here's how I did it:

---------------------
| eval i = mvrange(0,10)
| mvexpand i

----------------------

 

 

<my search>

| eval Time=_time
| stats values(Time) as Time by UserName

| eval i = mvrange(0,10)
| mvexpand i

| eval reconnection=if(UserName==UserName, tonumber(mvindex(Time,i+1))-tonumber(mvindex(Time,i)), "falha")
| where reconnection>0 AND reconnection<600

| eval reconnection=tostring(reconnection, "duration")

View solution in original post

0 Karma

carinahOliveira
Explorer

I managed to solve it and I'll leave the solution here in case anyone needs it.

As mentioned earlier, there is no way to create a loop, but we can create a range and use it to iterate

Here's how I did it:

---------------------
| eval i = mvrange(0,10)
| mvexpand i

----------------------

 

 

<my search>

| eval Time=_time
| stats values(Time) as Time by UserName

| eval i = mvrange(0,10)
| mvexpand i

| eval reconnection=if(UserName==UserName, tonumber(mvindex(Time,i+1))-tonumber(mvindex(Time,i)), "falha")
| where reconnection>0 AND reconnection<600

| eval reconnection=tostring(reconnection, "duration")

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Splunk doesn't have loops like programming languages.  The foreach and map commands let you iterate over fields or events, respectively, but those don't do what you describe.

The closest you can get is the streamstats command with the range function.  This command computes the difference between the current value of the 'time' field and the previous one.

| streamstats window=1 range(time) as Time

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...