Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Lead\ Lag in splunk?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi, when I work with SQL I find the "Lead\ Lag" function very crutial.
I'm using it mostly between dates.
Does splunk supply an alternative?
thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You could use streamstats (http://docs.splunk.com/Documentation/Splunk/4.3/SearchReference/Streamstats ). Say you want LAG(field):
... | streamstats current=f last(field) as last_field
For LEAD, just get the results in reverse order (using reverse).
You might also want to have a look at delta which computes differences between values of a field for different events. http://docs.splunk.com/Documentation/Splunk/4.3/SearchReference/Delta
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You could use streamstats (http://docs.splunk.com/Documentation/Splunk/4.3/SearchReference/Streamstats ). Say you want LAG(field):
... | streamstats current=f last(field) as last_field
For LEAD, just get the results in reverse order (using reverse).
You might also want to have a look at delta which computes differences between values of a field for different events. http://docs.splunk.com/Documentation/Splunk/4.3/SearchReference/Delta
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What if I want to lag values 7 rows apart (not just the previous one)?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
what do you want to achieve? any data sample to better understand?
Have you check this link:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SQLtoSplunk
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
