Splunk Search

Referencing a the next line or previous line

yuwtennis
Communicator

Hi !

I would like to get an advice with search command.

I want to do something like ,

Reference the next row (line n+1) and set a value to the field on current row (line n)

ex.
f1 f2 f3
1 2 3 (line n)
4 5 6 (line n+1)

if field f1 of line n+1 is 4 then set f4 of line n to 1 at line n

f1 f2 f3 f4
1 2 3 1 (line n)
4 5 6 (line n+1)

or

Reference the current line (line n) and set a value to the new field on previous line (line n-1)
ex.
f1 f2 f3
1 2 3 (line n-1)
4 5 6 (line n)

if field f1 of line n-1 is 1 then set f4 of line n-1 to 1 at line n

f1 f2 f3 f4
1 2 3 1 (line n-1)
4 5 6 (line n)

Any advice is appreciated!

Thanks,
Yu

Tags (1)
0 Karma

BobM
Builder

The streamstats command is designed to reference previous events. That is previous in the order you see them on screen so sorting will allow you to reference the next one. Try this.

mysearch | streamstats current=false window=1 first(f1) as next_f1 first(f2) as next_f2 
| sort  _time | streamstats current=false window=1 first(f1) as previous_f1 first(f2) as previous_f2 
| sort _time | table previous_f1 f1 next_f1 previous_f2 f2 next_f2

But be aware that streamstats does not map reduce so should be used as late as possible in a search string.

Bob

yuwtennis
Communicator

Hello Bob.

Yes. This is the command I was searching for .

Thanks!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...