Splunk Search

How do I find a pattern in a field that contains 10 digit numbers that increase by 1?

milky88
New Member

I have a field called data. Example of what is in the data field.
1234567890
9999999999
7638278823
1234567891
8475627744
1234567892

I am trying to extract data from the data field that show numbers that increase by 1.
ONLY would need the following:
1234567890
1234567891
1234567892
Not really sure where to start. Any help would greatly be appreciated.

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi milky88,
try something like this example:

| makeresults | eval my_field=1234567890
| append [ | makeresults | eval my_field=9999999999 ]
| append [ | makeresults | eval my_field=7638278823 ]
| append [ | makeresults | eval my_field=1234567891 ]
| append [ | makeresults | eval my_field=8475627744 ]
| append [ | makeresults | eval my_field=1234567892 ]
| sort my_field
| delta my_field AS delta
| fillnull value=0 delta
| where delta<2
| table my_field

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...