define constant value

[meenaoleti]

 time  | a1| a2| a3 | a4 |
today  | 1 | 4 | 8 | 5 |   
today-1| 1 | 3 | 6 | 5 | 
today-2| 1 | 2 | 5 | 5 | 
today-3| 1 | 1 | 4 | 5 | 

So I want to print a1 and a4 fields that these fields values are constant from past five days.

Is there any possibility to do the above scenario?

[adonio]

I hope i understand your requirement,

try this out anywhere

| makeresults count=1 
| eval data = "today|1|4|8|5;   
 today-1|1|3|6|5; 
 today-2|1|2|5|5 ;
 today-3|1|1|4|5 " 
| makemv delim=";" data 
| mvexpand data 
| rex field=data "(?<date>[^|]+)\|(?<a1>\d+)\|(?<a2>\d+)\|(?<a3>\d+)\|(?<a4>\d+)" 
| stats values(a*) as a* by date 
| rename COMMENT AS "Everything above generates sample data; everything below is your solution" 
| eventstats values(*) as * 
| head 1

hope it helps

[echalex]

It's a bit confusing when you combine the words "predict" and "past" in that way, but I assume you try to predict the future from the past.

I can't give you a complete solution as I don't know the base search, but have you considered these options?

1) calculate the standard deviation using stdev, constant values should have stdev=0.

2) calculate the min and the max for the value. If they are the same, the value hasn't changed.

[adonio]

hello there,
can you elaborate on your requirement?
what is it that you would like to accomplish? what is the desired outcome / results?

[meenaoleti]

Hi,

I want to predict the constant value from the past five days. for example, if you take share markets, it has so many company shares, so my goal is to find which share markets price is constant for past five days.

in that scenario, if you see above a1,a2,a3 are companies time is today, yesterday and day before yesterday.