Splunk Search

Avoid streamstats truncate to obtain previous value

DanielSp
Explorer

I have a index with the follow data:

KEY_ID, GROUP, DATE

With for example:
1, group1, 2021-06-01
1, group2, 2021-06-02
2, group1, 2021-06-01

...

I want to obtain next date value to show a table like:
1, group1, 2021-06-01,2021-06-02
1, group2, 2021-06-02,NULL

...

I know that I can sort It and use a command like streamstats:

| streamstats current=f last(DATE) as DATENEXT by KEY_ID

But, my issue is that my index have a million of records, so, the results are truncated to 10.000

Is there any way to obtain the DATENEXT without modify limits.conf for streamstats?

Thanks a lot¡

Regards

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Does window=1 help?

| streamstats window=1 current=f last(DATE) as DATENEXT by KEY_ID

View solution in original post

DanielSp
Explorer

Thanks a lot¡

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does window=1 help?

| streamstats window=1 current=f last(DATE) as DATENEXT by KEY_ID
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...