Splunk Search

Alternative to streamstats+last

duesser
Path Finder

I have this query, where I want to build a dataset from a variable and its 4 previous values. I can solve this like so:

 

 

 

| makeresults
| eval id=split("a,b,c,d,e,f,g",",")
| eval a=split("1,2,3,4,5,6,7",",")
| eval temp=mvzip(id,a,"|")
| mvexpand temp
| rex field=temp "(?P<id>[^|]+)\|(?P<a>[^|]+)"
| fields - temp
| streamstats current=false last(a) AS a_lag1
| streamstats current=false last(a_lag1) AS a_lag2
| streamstats current=false last(a_lag2) AS a_lag3
| streamstats current=false last(a_lag3) AS a_lag4
| where isnotnull(a_lag4)
| table id a*

 

 

 

However, if I want to extend this to say 100 previous values, this code would become convoluted and slow. I imagine there must be a better way to accomplish this goal, however my research has not produced any alternative.

Any ideas are appreciated.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Use autoregress something like this

| makeresults
| eval a=mvrange(1,102)
| mvexpand a
| autoregress a p=1-100

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Use autoregress something like this

| makeresults
| eval a=mvrange(1,102)
| mvexpand a
| autoregress a p=1-100

PickleRick
SplunkTrust
SplunkTrust

You mean something like

| streamstats <optionally current=f> window=10 list(myfield) <optionally BY another_field>
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...