search sequential numbers

[fizzletwist]

How can I search in Splunk to find events which contain sequential numbers in a given field?

[jonuwz]

is 1 number in a field, and sequential across events
or
sequential numbers in a field in 1 event ?

[Rob]

Nice tag, I think this splunk answer is now near the top of google search results

[kristian_kolb · Accepted solution]

Well, it depends on whether you want to sort your boobs..er..numbers at search time (sequentially), which could be accomplished with the sort command, e.g.;

your search | table _time boobs | sort boobs

If you want to ensure that you have sequential boobs without sorting, i.e. you want to know that they're in sequence from the start, you should have a look at the delta command, which will show the difference between the current and previous value. Thus it should be a numerical value.

your search | table _time boobs | delta boobs

_time          boobs     delta(boobs)
2013-01-01     32        
2013-01-02     33        1
2013-01-03     34        1
2013-01-04     35        1
2013-01-05     30        -5

Hope this helps,

K

[mloven_splunk]

heh... boobs...

[yannK]

interesting tags.