topic Re: How to create A new field which creates accumulative results from current and previous records of different field in Splunk Search

How to create A new field which creates accumulative results from current and previous records of different field

priyaramki16 — Tue, 16 Jun 2020 09:52:01 GMT

I have a two fields Calendar_week, Count...

I am trying to create a New field as Cumulative count which will add the previous cumulative count with Current Count.

For eg

Calender_week----Count----Cumulative_Count

1 ---- 0 ----0

2 ---- 1 ----1

3 ---- 2 ----3

Is there a search which could do this..

Thanks

javiergn — Tue, 16 Jun 2020 13:29:23 GMT

Take a look at streamstats:

In your case, something like the following should do the trick:

your query here | sort limit=0 "Calendar Week" | streamstats sum(count) as Cumulative_Count

Hope that helps

priyaramki16 — Tue, 16 Jun 2020 10:29:03 GMT

Hi @javiergn ...the query you suggested produced a field which is same as count but with first row not filled...

the addition did not happen

javiergn — Tue, 16 Jun 2020 13:27:25 GMT

I made a typo on my answer as I didn't have a lab to check my syntax. See the answer above again.

By the way, make sure your sort is working fine as there seems to be a trailing space in your query between "Calendar" and "Week"

priyaramki16 — Tue, 16 Jun 2020 13:43:26 GMT

Thanks!! It worked!!