prev
Adds the field value of the previous record to the field (e.g., prev_count) with the prefix prev_ to the next input record. This command is often used to capture the change in a data series.
Syntax
prev INPUT_FIELD, ...
Required Parameter
INPUT_FIELD, ...
- Fields to track its previous value, separated by a comma (
,
). The command saves the value of the previous record of the specified fields to the field with the prefix prev_.
Usage
-
Calculate the amount of change in GC count every minute.
table sys_gc_logs | timechart span=1m count | prev count | eval delta = count - prev_count
-
Retrieve GC logs with a GC occurrence interval of 10 seconds or less.
table order=asc sys_gc_logs | prev _time | eval interval = datediff(prev__time, _time, "sec") | search interval < 10