Splunk Search

How do I find a pattern in a field that contains 10 digit numbers that increase by 1?

milky88
New Member

I have a field called data. Example of what is in the data field.
1234567890
9999999999
7638278823
1234567891
8475627744
1234567892

I am trying to extract data from the data field that show numbers that increase by 1.
ONLY would need the following:
1234567890
1234567891
1234567892
Not really sure where to start. Any help would greatly be appreciated.

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi milky88,
try something like this example:

| makeresults | eval my_field=1234567890
| append [ | makeresults | eval my_field=9999999999 ]
| append [ | makeresults | eval my_field=7638278823 ]
| append [ | makeresults | eval my_field=1234567891 ]
| append [ | makeresults | eval my_field=8475627744 ]
| append [ | makeresults | eval my_field=1234567892 ]
| sort my_field
| delta my_field AS delta
| fillnull value=0 delta
| where delta<2
| table my_field

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...