Splunk Search

Retrieve events grouped by event order (first 5, next 5, etc...)

dawfun
New Member

I have no clue how to do this. I've tried autoregress, and I expect it shoudl work, but I end up with gaps in the new field...the original field is continuous.

What I want to do is get stats on the most recent 5 events in my search, and then grab the same stats for the previous 5 events. I can get something close if I do it on a time-basis, but I really want to do this on a event-basis. What I'd like to do is retrieve 10 events in my search (not hard to do) then operate on the first 5 and the last 5 as two distinct groupings of values.

Any ideas?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

In order to split a call to stats by groups of five events you could do something like this:

your search pipeline that yields a multiple of five events | streamstats current=f count as segment | eval segment = floor(segment / 5) | stats foo(bar) by segment

The field segment will be 0 for the first five events, 1 for the second five, and so on.

0 Karma

dawfun
New Member

I'll give that a shot. Thanks.

0 Karma

dawfun
New Member

I figured out the gaps issue with auto regress (sorting, duh). Still looking for a solution.

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...