Lead\ Lag in splunk?

[Yarsa]

Hi, when I work with SQL I find the "Lead\ Lag" function very crutial.
I'm using it mostly between dates.
Does splunk supply an alternative?
thanks!

[Ayn · Accepted solution]

You could use streamstats (http://docs.splunk.com/Documentation/Splunk/4.3/SearchReference/Streamstats ). Say you want LAG(field):

... | streamstats current=f last(field) as last_field

For LEAD, just get the results in reverse order (using reverse).

You might also want to have a look at delta which computes differences between values of a field for different events. http://docs.splunk.com/Documentation/Splunk/4.3/SearchReference/Delta

[Yarsa]

What if I want to lag values 7 rows apart (not just the previous one)?

[MarioM]

what do you want to achieve? any data sample to better understand?
Have you check this link:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SQLtoSplunk