how to make loop in splunk query

[carinahOliveira]

I have a query that returns multiple times and I need to step through this result doing a subtraction count between one and the other.

Example:
Time = time[0] - time[1]
Time = time[1] - time[2]

etc ....

My search looks like this:

<my search>
| eval Time=_time
| stats values(Time) as Time by UserName| eval reconnection=if(UserName == UserName, tonumber(mvindex(Time,1))-tonumber(mvindex(Time,0)), "falha")
| where reconnection>0 AND reconnection<600
| eval reconnection=tostring(reconnection, "duration")

[carinahOliveira · Accepted solution]

I managed to solve it and I'll leave the solution here in case anyone needs it.

As mentioned earlier, there is no way to create a loop, but we can create a range and use it to iterate

Here's how I did it:

---------------------
| eval i = mvrange(0,10)
| mvexpand i

----------------------

<my search>

| eval Time=_time
| stats values(Time) as Time by UserName

| eval i = mvrange(0,10)
| mvexpand i

| eval reconnection=if(UserName==UserName, tonumber(mvindex(Time,i+1))-tonumber(mvindex(Time,i)), "falha")
| where reconnection>0 AND reconnection<600

| eval reconnection=tostring(reconnection, "duration")

[richgalloway]

Splunk doesn't have loops like programming languages.  The foreach and map commands let you iterate over fields or events, respectively, but those don't do what you describe.

The closest you can get is the streamstats command with the range function.  This command computes the difference between the current value of the 'time' field and the previous one.

| streamstats window=1 range(time) as Time