Splunk Search

How do I find a pattern in a field that contains 10 digit numbers that increase by 1?

milky88
New Member

I have a field called data. Example of what is in the data field.
1234567890
9999999999
7638278823
1234567891
8475627744
1234567892

I am trying to extract data from the data field that show numbers that increase by 1.
ONLY would need the following:
1234567890
1234567891
1234567892
Not really sure where to start. Any help would greatly be appreciated.

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi milky88,
try something like this example:

| makeresults | eval my_field=1234567890
| append [ | makeresults | eval my_field=9999999999 ]
| append [ | makeresults | eval my_field=7638278823 ]
| append [ | makeresults | eval my_field=1234567891 ]
| append [ | makeresults | eval my_field=8475627744 ]
| append [ | makeresults | eval my_field=1234567892 ]
| sort my_field
| delta my_field AS delta
| fillnull value=0 delta
| where delta<2
| table my_field

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...