Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Lead\ Lag in splunk?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi, when I work with SQL I find the "Lead\ Lag" function very crutial.
I'm using it mostly between dates.
Does splunk supply an alternative?
thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You could use streamstats (http://docs.splunk.com/Documentation/Splunk/4.3/SearchReference/Streamstats ). Say you want LAG(field):
... | streamstats current=f last(field) as last_field
For LEAD, just get the results in reverse order (using reverse).
You might also want to have a look at delta which computes differences between values of a field for different events. http://docs.splunk.com/Documentation/Splunk/4.3/SearchReference/Delta
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You could use streamstats (http://docs.splunk.com/Documentation/Splunk/4.3/SearchReference/Streamstats ). Say you want LAG(field):
... | streamstats current=f last(field) as last_field
For LEAD, just get the results in reverse order (using reverse).
You might also want to have a look at delta which computes differences between values of a field for different events. http://docs.splunk.com/Documentation/Splunk/4.3/SearchReference/Delta
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What if I want to lag values 7 rows apart (not just the previous one)?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
what do you want to achieve? any data sample to better understand?
Have you check this link:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SQLtoSplunk
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Network to App: Observability Unlocked [May & June Series]
SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...
[Puzzles] Solve, Learn, Repeat: Matching cron expressions
