stats/streamstats to display only last 2 result/row

[yuming1127]

Hi, i'm looking for a solution which only show the last and last-1 result using stats or streamstats function.  Aim is to only display something like max(row) and max(row)-1

my search...

| stats values(product_tag*) as product_tag* values(*) as * by product,color,product_tag

outcome

product	color	product_tag	description
phone	red	abc_1	blabla1
phone	red	abc_2	blabla2
phone	red	abc_3	blabla3
phone	red	abc_4	blabla4

desired outcome

product	color	product_tag	description
phone	red	abc_3	blabla3
phone	red	abc_4	blabla4

 or 

product	color	product_tag	description
phone	red	abc_4	blabla4
phone	red	abc_3	blabla3

[yuming1127]

Great one KV,

one more addition question,  how do i display the product_tag i search and the one previous of it.

For example:

my search...

| stats values(product_tag*) as product_tag* values(*) as * by product,color,product_tag

|  search product_tag=abc_3 

Outcome

product	color	product_tag	description
phone	red	abc_3	blabla3

Desired outcome

t	color	product_tag	description
phone	red	abc_2	blabla2
phone	red	abc_3	blabla3

really appreciate your help.

[kamlesh_vaghela]

@yuming1127 

For your search product_tag  scenario try this. 

YOUR_SEARCH
| eval a=1 , search_product_tag="YOUR_SEARCH_TAG"
| accum a 
| eventstats max(eval(if(search_product_tag==product_tag,a,null()))) as mx
| where a=mx OR a=mx-1
| table product	color	product_tag	description

Sample Search:

| makeresults 
| eval _raw="product	color	product_tag	description
phone	red	abc_1	blabla1
phone	red	abc_2	blabla2
phone	red	abc_3	blabla3
phone	red	abc_4	blabla4" 
| multikv forceheader=1 
| table product color product_tag description 
| eval a=1 , search_product_tag="abc_3"
| accum a 
| eventstats max(eval(if(search_product_tag==product_tag,a,null()))) as mx
| where a=mx OR a=mx-1
| table product	color	product_tag	description

Thanks
KV
▄︻̷̿┻̿═━一

If this reply helps you, an upvote would be appreciated.

[kamlesh_vaghela · Accepted solution]

@yuming1127 

try this.

YOUR_SEARCH
| eval a=1 | accum a | eventstats max(a) as mx | where a=mx OR a=mx-1

Sample:

| makeresults 
| eval _raw="product	color	product_tag	description
phone	red	abc_1	blabla1
phone	red	abc_2	blabla2
phone	red	abc_3	blabla3
phone	red	abc_4	blabla4" 
| multikv forceheader=1 
| table product color product_tag description
| eval a=1 | accum a | eventstats max(a) as mx | where a=mx OR a=mx-1

Thanks
KV
▄︻̷̿┻̿═━一

If this reply helps you, an upvote would be appreciated.