Splunk Search

Alternative to streamstats+last

duesser
Path Finder

I have this query, where I want to build a dataset from a variable and its 4 previous values. I can solve this like so:

 

 

 

| makeresults
| eval id=split("a,b,c,d,e,f,g",",")
| eval a=split("1,2,3,4,5,6,7",",")
| eval temp=mvzip(id,a,"|")
| mvexpand temp
| rex field=temp "(?P<id>[^|]+)\|(?P<a>[^|]+)"
| fields - temp
| streamstats current=false last(a) AS a_lag1
| streamstats current=false last(a_lag1) AS a_lag2
| streamstats current=false last(a_lag2) AS a_lag3
| streamstats current=false last(a_lag3) AS a_lag4
| where isnotnull(a_lag4)
| table id a*

 

 

 

However, if I want to extend this to say 100 previous values, this code would become convoluted and slow. I imagine there must be a better way to accomplish this goal, however my research has not produced any alternative.

Any ideas are appreciated.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Use autoregress something like this

| makeresults
| eval a=mvrange(1,102)
| mvexpand a
| autoregress a p=1-100

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Use autoregress something like this

| makeresults
| eval a=mvrange(1,102)
| mvexpand a
| autoregress a p=1-100

PickleRick
SplunkTrust
SplunkTrust

You mean something like

| streamstats <optionally current=f> window=10 list(myfield) <optionally BY another_field>
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...