How can I search in Splunk to find events which contain sequential numbers in a given field?
Well, it depends on whether you want to sort your boobs..er..numbers at search time (sequentially), which could be accomplished with the sort
command, e.g.;
your search | table _time boobs | sort boobs
If you want to ensure that you have sequential boobs without sorting, i.e. you want to know that they're in sequence from the start, you should have a look at the delta command, which will show the difference between the current and previous value. Thus it should be a numerical value.
your search | table _time boobs | delta boobs
_time boobs delta(boobs)
2013-01-01 32
2013-01-02 33 1
2013-01-03 34 1
2013-01-04 35 1
2013-01-05 30 -5
Hope this helps,
K
is 1 number in a field, and sequential across events
or
sequential numbers in a field in 1 event ?
Nice tag, I think this splunk answer is now near the top of google search results
Well, it depends on whether you want to sort your boobs..er..numbers at search time (sequentially), which could be accomplished with the sort
command, e.g.;
your search | table _time boobs | sort boobs
If you want to ensure that you have sequential boobs without sorting, i.e. you want to know that they're in sequence from the start, you should have a look at the delta command, which will show the difference between the current and previous value. Thus it should be a numerical value.
your search | table _time boobs | delta boobs
_time boobs delta(boobs)
2013-01-01 32
2013-01-02 33 1
2013-01-03 34 1
2013-01-04 35 1
2013-01-05 30 -5
Hope this helps,
K
heh... boobs...
interesting tags.