Splunk Search

splunk query request to identify a continous sequence of number


i have a below data generated by a timechart  i'm trying to write a query where if there are continous sequence of number 1 in a span of 15 mins  it should alert me 

index=abc  "Heartbeat*"  |timechart span=2m count 

2021-10-04 10:20:001
2021-10-04 10:22:001
2021-10-04 10:24:001
2021-10-04 10:26:001
2021-10-04 10:28:001


when the


Labels (1)
0 Karma

Revered Legend

Give this a try

index=abc  "Heartbeat*"  |timechart span=2m count 
| streamstats current=f window=1 values(count) as prev_count
| stats sum(eval(abs(count-prev_count))) as diff
| where diff=0

Basically comparing every row's count value with previous row's count value and checking if difference is 0 (means they're all same).

0 Karma


There is a command especially for using previous values - autoregress

So checking if the value is the same as previous one is easier:

<your-search> | autoregress field
| where field=field_p1

But I think I'd use a transaction here. With resetonchange=t

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...