Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Retrieve events grouped by event order (first 5, next 5, etc...)

$
0
0

I have no clue how to do this. I've tried autoregress, and I expect it shoudl work, but I end up with gaps in the new field...the original field is continuous.

What I want to do is get stats on the most recent 5 events in my search, and then grab the same stats for the previous 5 events. I can get something close if I do it on a time-basis, but I really want to do this on a event-basis. What I'd like to do is retrieve 10 events in my search (not hard to do) then operate on the first 5 and the last 5 as two distinct groupings of values.

Any ideas?


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>