prev

Adds the field value of the previous record to the field (e.g., prev_count) with the prefix prev_ to the next input record. This command is often used to capture the change in a data series.

Syntax

prev INPUT_FIELD, ...
Required Parameter
INPUT_FIELD, ...
Fields to track its previous value, separated by a comma (,). The command saves the value of the previous record of the specified fields to the field with the prefix prev_.

Usage

  1. Calculate the amount of change in GC count every minute.

    table sys_gc_logs 
    | timechart span=1m count 
    | prev count 
    | eval delta = count - prev_count
    
  2. Retrieve GC logs with a GC occurrence interval of 10 seconds or less.

    table order=asc sys_gc_logs 
    | prev _time 
    | eval interval = datediff(prev__time, _time, "sec") 
    | search interval < 10