splunk query request to identify a continous sequence of number

[venky1544]

i have a below data generated by a timechart  i'm trying to write a query where if there are continous sequence of number 1 in a span of 15 mins  it should alert me 

index=abc  "Heartbeat*"  |timechart span=2m count 

2021-10-04 10:20:00	1
2021-10-04 10:22:00	1
2021-10-04 10:24:00	1
2021-10-04 10:26:00	1
2021-10-04 10:28:00	1

when the

[somesoni2]

Give this a try

index=abc  "Heartbeat*"  |timechart span=2m count 
| streamstats current=f window=1 values(count) as prev_count
| stats sum(eval(abs(count-prev_count))) as diff
| where diff=0

Basically comparing every row's count value with previous row's count value and checking if difference is 0 (means they're all same).

[PickleRick]

There is a command especially for using previous values - autoregress

So checking if the value is the same as previous one is easier:

<your-search> | autoregress field
| where field=field_p1

But I think I'd use a transaction here. With resetonchange=t