Splunk Search

Avoid streamstats truncate to obtain previous value

DanielSp
Explorer

I have a index with the follow data:

KEY_ID, GROUP, DATE

With for example:
1, group1, 2021-06-01
1, group2, 2021-06-02
2, group1, 2021-06-01

...

I want to obtain next date value to show a table like:
1, group1, 2021-06-01,2021-06-02
1, group2, 2021-06-02,NULL

...

I know that I can sort It and use a command like streamstats:

| streamstats current=f last(DATE) as DATENEXT by KEY_ID

But, my issue is that my index have a million of records, so, the results are truncated to 10.000

Is there any way to obtain the DATENEXT without modify limits.conf for streamstats?

Thanks a lot¡

Regards

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Does window=1 help?

| streamstats window=1 current=f last(DATE) as DATENEXT by KEY_ID

View solution in original post

DanielSp
Explorer

Thanks a lot¡

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does window=1 help?

| streamstats window=1 current=f last(DATE) as DATENEXT by KEY_ID
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...