rows_near plugin

Learn how to use the rows_near plugin to find rows near a specified condition.

Finds rows near a specified condition.

The plugin is invoked with the evaluate operator.

Syntax

T | evaluate rows_near(Condition, NumRows, [, RowsAfter ])

Parameters

NameTypeRequiredDescription
Tstring✔️The input tabular expression.
Conditionbool✔️Represents the condition to find rows around.
NumRowsint✔️The number of rows to find before and after the condition.
RowsAfterintWhen specified, overrides the number of rows to find after the condition.

Returns

Every row from the input that is within NumRows from a true Condition, When RowsAfter is specified, returns every row from the input that is NumRows before or RowsAfter after a true Condition.

Example

Find rows with an "Error" State, and returns 2 rows before and after the "Error" record.

datatable (Timestamp:datetime, Value:long, State:string )
[
    datetime(2021-06-01), 1, "Success",
    datetime(2021-06-02), 4, "Success",
    datetime(2021-06-03), 3, "Success",
    datetime(2021-06-04), 11, "Success",
    datetime(2021-06-05), 15, "Success",
    datetime(2021-06-06), 2, "Success",
    datetime(2021-06-07), 19, "Error",
    datetime(2021-06-08), 12, "Success",
    datetime(2021-06-09), 7, "Success",
    datetime(2021-06-10), 9, "Success",
    datetime(2021-06-11), 4, "Success",
    datetime(2021-06-12), 1, "Success",
]
| sort by Timestamp asc 
| evaluate rows_near(State == "Error", 2)

Output

TimestampValueState
2021-06-05 00:00:00.000000015Success
2021-06-06 00:00:00.00000002Success
2021-06-07 00:00:00.000000019Error
2021-06-08 00:00:00.000000012Success
2021-06-09 00:00:00.00000007Success