Splunk Search

How to pick a values are in sequence using streamstats greater than 8 continuous value

DataOrg
Builder

If a streamstats sequence value is continuous to 1-10 values. i need to pick entire count of data . My search is | streamstats reset_on_change=true count(value_TS) AS Sequence BY incremented TS
for example: if sequence is equal to 4 or greater than 3. i need to pick all 4 values ie(1-4) or else skip
mockUp data
streamsstats
1
2
3
4
1
1
1
2
3

0 Karma
1 Solution

to4kawa
Ultra Champion
your_search
| streamstats reset_on_change=true count(value_TS) AS Sequence BY incremented TS
| reverse
| streamstats reset_after="Sequence=1" count(eval(Sequence>=4)) as flag
| reverse
| where flag > 0

Hi, @premranjithj
How about this?

View solution in original post

0 Karma

somesoni2
Revered Legend

Whats the expected output of your sample data?

0 Karma

to4kawa
Ultra Champion
your_search
| streamstats reset_on_change=true count(value_TS) AS Sequence BY incremented TS
| reverse
| streamstats reset_after="Sequence=1" count(eval(Sequence>=4)) as flag
| reverse
| where flag > 0

Hi, @premranjithj
How about this?

0 Karma

DataOrg
Builder

@to4kawa Super !!! thanks 🙂 worked

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this untested search:

...  | streamstats reset_on_change=true count(value_TS) AS Sequence BY incremented TS
| streamstats max(Sequence) as Max
| where Max > 3
| ...
---
If this reply helps you, Karma would be appreciated.
0 Karma

DataOrg
Builder

the max value is following the change in sequence value too. i need only the first 4 values and if the sequence is followed in other sequence need to pick the fresh set of values

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...