https://community.splunk.com/t5/Splunk-Search/cumulative-sum-in-splunk/m-p/63070#M15571 <P>Hi,</P> <P>I have uploaded csv files for indexing and creating reports.Here is the sample entries:</P> <PRE><CODE> Date A B 1.08.2013 8 17 2.08.2013 9 15 3.08.2013 11 20 4.08.2013 8 18 </CODE></PRE> <P>and my expected result is </P> <PRE><CODE> Date A B Difference Cumulative_sum 1.08.2013 8 17 9 9 2.08.2013 9 15 6 15 3.08.2013 11 20 9 24 4.08.2013 8 18 10 34 </CODE></PRE> <P>Here i wanted to calculate cumulative sum and show it on a chart.Does splunk provide any direct function to calculate cumulative sum? How to do this?</P> <P>Thank you</P> Fri, 13 Sep 2013 09:50:38 GMT shreeCS 2013-09-13T09:50:38Z https://community.splunk.com/t5/Splunk-Search/cumulative-sum-in-splunk/m-p/63070#M15571 <P>Hi,</P> <P>I have uploaded csv files for indexing and creating reports.Here is the sample entries:</P> <PRE><CODE> Date A B 1.08.2013 8 17 2.08.2013 9 15 3.08.2013 11 20 4.08.2013 8 18 </CODE></PRE> <P>and my expected result is </P> <PRE><CODE> Date A B Difference Cumulative_sum 1.08.2013 8 17 9 9 2.08.2013 9 15 6 15 3.08.2013 11 20 9 24 4.08.2013 8 18 10 34 </CODE></PRE> <P>Here i wanted to calculate cumulative sum and show it on a chart.Does splunk provide any direct function to calculate cumulative sum? How to do this?</P> <P>Thank you</P> Fri, 13 Sep 2013 09:50:38 GMT https://community.splunk.com/t5/Splunk-Search/cumulative-sum-in-splunk/m-p/63070#M15571 shreeCS 2013-09-13T09:50:38Z https://community.splunk.com/t5/Splunk-Search/cumulative-sum-in-splunk/m-p/63071#M15572 <P>add this :</P> <PRE><CODE>| streamstats sum(Difference) as Cumulative_sum </CODE></PRE> Fri, 13 Sep 2013 12:06:07 GMT https://community.splunk.com/t5/Splunk-Search/cumulative-sum-in-splunk/m-p/63071#M15572 jonuwz 2013-09-13T12:06:07Z https://community.splunk.com/t5/Splunk-Search/cumulative-sum-in-splunk/m-p/63072#M15573 <P>yes,the above solution is working fine but if i want to calculate cumulative sum by host ,how to do that?<BR /> " |streamstats sum(difference) as cumulative_sum by host" doesn't work here</P> Sun, 15 Sep 2013 14:39:59 GMT https://community.splunk.com/t5/Splunk-Search/cumulative-sum-in-splunk/m-p/63072#M15573 shreeCS 2013-09-15T14:39:59Z https://community.splunk.com/t5/Splunk-Search/cumulative-sum-in-splunk/m-p/63073#M15574 <P>Here i wanted to show cumulative sum of each host on a chart.How to do that.If i take single host i'm able to do if there are multiple hosts,then how query should be modified?</P> Mon, 16 Sep 2013 04:19:52 GMT https://community.splunk.com/t5/Splunk-Search/cumulative-sum-in-splunk/m-p/63073#M15574 shreeCS 2013-09-16T04:19:52Z https://community.splunk.com/t5/Splunk-Search/cumulative-sum-in-splunk/m-p/63074#M15575 <P>i come up with some solution query as given below,but here the problem is cumulative sum is in the reverse order i.e., if i take for August month data,for August 1st its 205 as cumulative sum and for August 31st 8 but this should be in a reverse order i.e ,August 1st 8 ,august2 19...august 31st 205 as a sum</P> Mon, 16 Sep 2013 04:42:30 GMT https://community.splunk.com/t5/Splunk-Search/cumulative-sum-in-splunk/m-p/63074#M15575 shreeCS 2013-09-16T04:42:30Z https://community.splunk.com/t5/Splunk-Search/cumulative-sum-in-splunk/m-p/63075#M15576 <P>The query is <BR /> "sourcetype="csv-5" | convert mstime(Out_Time_<EM>hh_mm</EM>) AS outtime | convert mstime(In_Time_<EM>hh_mm</EM>) AS intime |eval durationHrs=(outtime - intime )/60 | streamstats sum(durationHrs) as cumulativeSum by host | timechart values(cumulativeSum) by host "</P> Mon, 28 Sep 2020 14:46:45 GMT https://community.splunk.com/t5/Splunk-Search/cumulative-sum-in-splunk/m-p/63075#M15576 shreeCS 2020-09-28T14:46:45Z