Splunk Search

How to return the most recent 2 values of X by Y?

the_wolverine
Champion

Stats can be used to get the most recent X value of Y, for example:
| stats latest(x) by y

How do I get the most recent 2 values of X by Y for comparing change in the value of X.

0 Karma
1 Solution

somesoni2
Revered Legend

Try this

your base search
| dedup 2 y
| stats latest(x) as Current earliest(x) as Previous by y

View solution in original post

niketnilay
Legend

@the_wolverine, Try the following run anywhere search based on Splunk's _internal index (x is date_second and y is component)

index="_internal" sourcetype="splunkd" log_level!="INFO" component!="ConfContentsCache"
| stats list(date_second) as date_second by component
| eval latest=mvindex(date_second,0), previous=mvindex(date_second,1)
| fillnull value=0 latest previous
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

somesoni2
Revered Legend

Try this

your base search
| dedup 2 y
| stats latest(x) as Current earliest(x) as Previous by y

View solution in original post

the_wolverine
Champion

You Rock!

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!