Splunk Search

search sequential numbers

fizzletwist
Engager

How can I search in Splunk to find events which contain sequential numbers in a given field?

0 Karma
1 Solution

kristian_kolb
Ultra Champion

Well, it depends on whether you want to sort your boobs..er..numbers at search time (sequentially), which could be accomplished with the sort command, e.g.;

your search | table _time boobs | sort boobs

If you want to ensure that you have sequential boobs without sorting, i.e. you want to know that they're in sequence from the start, you should have a look at the delta command, which will show the difference between the current and previous value. Thus it should be a numerical value.

your search | table _time boobs | delta boobs

_time          boobs     delta(boobs)
2013-01-01     32        
2013-01-02     33        1
2013-01-03     34        1
2013-01-04     35        1
2013-01-05     30        -5

Hope this helps,

K

View solution in original post

jonuwz
Influencer

is 1 number in a field, and sequential across events
or
sequential numbers in a field in 1 event ?

0 Karma

Rob
Splunk Employee
Splunk Employee

Nice tag, I think this splunk answer is now near the top of google search results

0 Karma

kristian_kolb
Ultra Champion

Well, it depends on whether you want to sort your boobs..er..numbers at search time (sequentially), which could be accomplished with the sort command, e.g.;

your search | table _time boobs | sort boobs

If you want to ensure that you have sequential boobs without sorting, i.e. you want to know that they're in sequence from the start, you should have a look at the delta command, which will show the difference between the current and previous value. Thus it should be a numerical value.

your search | table _time boobs | delta boobs

_time          boobs     delta(boobs)
2013-01-01     32        
2013-01-02     33        1
2013-01-03     34        1
2013-01-04     35        1
2013-01-05     30        -5

Hope this helps,

K

View solution in original post

mloven_splunk
Splunk Employee
Splunk Employee

heh... boobs...

0 Karma

yannK
Splunk Employee
Splunk Employee

interesting tags.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!