On This Page

Home / Search/ Language Reference/ Functions/ Window Functions/next

next

The next function returns the value of a specific field in a subsequent row. The subsequent row is located at a specified offset relative to the current row within the results.

Syntax
​

`next(Field [, Offset ] [, DefaultValue ] )`

Arguments
​

  • Field: The field from which to get the values.
  • Offset: The number of rows to move from the current row. Default is 1.
  • DefaultValue: The default value when there’s no value in the later row. The default is null.

Scope
​

Cribl Search supports this function in the extend operator, but not in the project or where operator.

Examples
​

This example returns the time difference between adjacent events.

dataset="cribl_search_sample" dataSource="access*" host="web01.cribl.io"
 | limit 100
 | sort by _time asc
 | extend time_next_delta = next(_time) - (_time)
Run in Cribl Search

This example filters for events with a time difference greater than 250 ms:

dataset=myDataset
| where SensorName == 'sensor-9'
| sort by Timestamp asc
| extend timeDiffInMilliseconds = datetime_diff('millisecond', next(Timestamp, 1), Timestamp)
| where timeDiffInMilliseconds > 250