Splunk Search

How do I find a pattern in a field that contains 10 digit numbers that increase by 1?

milky88
New Member

I have a field called data. Example of what is in the data field.
1234567890
9999999999
7638278823
1234567891
8475627744
1234567892

I am trying to extract data from the data field that show numbers that increase by 1.
ONLY would need the following:
1234567890
1234567891
1234567892
Not really sure where to start. Any help would greatly be appreciated.

Tags (1)
0 Karma

gcusello
Esteemed Legend

Hi milky88,
try something like this example:

| makeresults | eval my_field=1234567890
| append [ | makeresults | eval my_field=9999999999 ]
| append [ | makeresults | eval my_field=7638278823 ]
| append [ | makeresults | eval my_field=1234567891 ]
| append [ | makeresults | eval my_field=8475627744 ]
| append [ | makeresults | eval my_field=1234567892 ]
| sort my_field
| delta my_field AS delta
| fillnull value=0 delta
| where delta<2
| table my_field

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...