topic Re: Streamstats count in Splunk Search

Streamstats count

pranaynanda — Tue, 08 Aug 2017 15:08:28 GMT

I want a cumulative count of a field that has multiple values. Somehow this isn't working:

base search| streamstats count(State) as dur time_window=1w| timechart sum(dur) by State span=1w

cmerriman — Tue, 08 Aug 2017 15:12:08 GMT

can you give some example data and expected results? a few more details might make this easier to answer, thanks 🙂

you might need to sort your events before your streamstats since you're doing a time_window.

somesoni2 — Tue, 08 Aug 2017 15:17:42 GMT

How about this?

base search| timechart count by State span=1w |  streamstats sum(*) as *

woodcock — Tue, 08 Aug 2017 15:51:26 GMT

Please explain your use case (your desired ending dataset).

pranaynanda — Tue, 08 Aug 2017 15:53:35 GMT

this pretty much solves it except that I see the results split into months instead of weeks as desired.

pranaynanda — Tue, 08 Aug 2017 15:56:00 GMT

something like this does solve my problem as @somesoni2 suggested but I would like to see data split into weeks instead of months:

 base search| timechart count by State span=1w |  streamstats sum(*) as *

pranaynanda — Tue, 08 Aug 2017 15:56:17 GMT

something like this does solve my problem as @somesoni2 suggested but I would like to see data split into weeks instead of months:

 base search| timechart count by State span=1w |  streamstats sum(*) as *

somesoni2 — Tue, 08 Aug 2017 16:16:39 GMT

Try this (always have span just after timechart command)

base search| timechart span=1w count by State |  streamstats sum(*) as *

pranaynanda — Tue, 08 Aug 2017 16:25:14 GMT

Voila! You're there! Thanks! I expect some admin to convert your comment to the answer! Amazing job! Thank you.

s2_splunk — Tue, 08 Aug 2017 16:45:03 GMT

And the community expects you to accept the answer, please. 😉