https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-quot-Moving-quot-sum-of-the-last-52-weeks/m-p/340686#M101035 <P>hey I think you want something like this</P> <PRE><CODE>&lt;your_base_search&gt; | eval dateweek_year=strftime(_time,"%Y-%U") | chart count as Num_Incidents over dateweek_year | streamstats sum(Num_Incidents) as "Moving_SUM" window=52 </CODE></PRE> <P><STRONG>So, you will get cumulative sum of last 52 weeks at any point of time.</STRONG> <BR /> let me know if this helps!</P> Wed, 31 Jan 2018 09:41:39 GMT mayurr98 2018-01-31T09:41:39Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-quot-Moving-quot-sum-of-the-last-52-weeks/m-p/340684#M101033 <P>Splunkers!<BR /> I have a new problem I'm not able to solve, I hope you can help me...</P> <P>Basically, I'm counting the number of incidents occurring on weekly basis related to the last 2 years (events beginning in Jan 2016):</P> <PRE><CODE>... | eval dateweek_year=strftime(_time,"%Y-%U") | chart count as Num_Incidents over dateweek_year </CODE></PRE> <P>Now, I'd like to present the outcome as "moving sum" of the last 52 weeks, starting from Jan 2017.<BR /> So 01-2017 period has to show the sum of incidents from 02-2016 to 01-2017, <BR /> 02-2017 from 03-2016 to 02-2017<BR /> etc...</P> <P>Any help?</P> <P>I've no clue about how to do it...</P> <P>Eventstats/Streamstats should help?</P> <P>Tks!<BR /> Carmine</P> Wed, 31 Jan 2018 08:30:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-quot-Moving-quot-sum-of-the-last-52-weeks/m-p/340684#M101033 CarmineCalo 2018-01-31T08:30:47Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-quot-Moving-quot-sum-of-the-last-52-weeks/m-p/340685#M101034 <P>@CarmineCalo, Please try the following and confirm</P> <PRE><CODE> &lt;YourBaseSearch&gt; | eval dateweek_year=strftime(_time,"%Y-%U") | chart count as Num_Incidents over dateweek_year | accum Num_Incidents </CODE></PRE> Wed, 31 Jan 2018 08:52:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-quot-Moving-quot-sum-of-the-last-52-weeks/m-p/340685#M101034 niketn 2018-01-31T08:52:56Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-quot-Moving-quot-sum-of-the-last-52-weeks/m-p/340686#M101035 <P>hey I think you want something like this</P> <PRE><CODE>&lt;your_base_search&gt; | eval dateweek_year=strftime(_time,"%Y-%U") | chart count as Num_Incidents over dateweek_year | streamstats sum(Num_Incidents) as "Moving_SUM" window=52 </CODE></PRE> <P><STRONG>So, you will get cumulative sum of last 52 weeks at any point of time.</STRONG> <BR /> let me know if this helps!</P> Wed, 31 Jan 2018 09:41:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-quot-Moving-quot-sum-of-the-last-52-weeks/m-p/340686#M101035 mayurr98 2018-01-31T09:41:39Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-quot-Moving-quot-sum-of-the-last-52-weeks/m-p/340687#M101036 <P>This option works, great <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>Tks!<BR /> Carmine</P> Wed, 31 Jan 2018 11:58:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-quot-Moving-quot-sum-of-the-last-52-weeks/m-p/340687#M101036 CarmineCalo 2018-01-31T11:58:32Z