https://community.splunk.com/t5/Splunk-Search/Funnel-by-Field/m-p/39301#M178780 <P>Append this:</P> <PRE><CODE>... | streamstats sum(Count) as Count </CODE></PRE> Mon, 20 May 2013 08:21:54 GMT martin_mueller 2013-05-20T08:21:54Z https://community.splunk.com/t5/Splunk-Search/Funnel-by-Field/m-p/39300#M178779 <P>... | table Field Count | sort 0 Field</P> <P>For example, we have<BR /> <TABLE><BR /> <TBODY><TR><BR /> <TD>Field</TD><BR /> <TD>Count</TD><BR /> </TR><BR /> <TR><BR /> <TD>n1</TD><BR /> <TD> 1</TD><BR /> </TR><BR /> <TR><BR /> <TD>n2</TD><BR /> <TD> 10</TD><BR /> </TR><BR /> <TR><BR /> <TD>n3</TD><BR /> <TD> 100</TD><BR /> </TR><BR /> <TR><BR /> <TD>n4</TD><BR /> <TD> 1000</TD><BR /> </TR><BR /> </TBODY></TABLE></P> <P>How can I make funnel like this?<BR /> <TABLE><BR /> <TBODY><TR><BR /> <TD>Field</TD><BR /> <TD>Count</TD><BR /> </TR><BR /> <TR><BR /> <TD>n1</TD><BR /> <TD> 1</TD><BR /> </TR><BR /> <TR><BR /> <TD>n2</TD><BR /> <TD> 11</TD><BR /> </TR><BR /> <TR><BR /> <TD>n3</TD><BR /> <TD> 111</TD><BR /> </TR><BR /> <TR><BR /> <TD>n4</TD><BR /> <TD> 1111</TD><BR /> </TR><BR /> </TBODY></TABLE></P> <P>Value of Funnel is equal to sum of previous value of Funnel and current value of Count.</P> Mon, 20 May 2013 08:15:55 GMT https://community.splunk.com/t5/Splunk-Search/Funnel-by-Field/m-p/39300#M178779 Timeago 2013-05-20T08:15:55Z https://community.splunk.com/t5/Splunk-Search/Funnel-by-Field/m-p/39301#M178780 <P>Append this:</P> <PRE><CODE>... | streamstats sum(Count) as Count </CODE></PRE> Mon, 20 May 2013 08:21:54 GMT https://community.splunk.com/t5/Splunk-Search/Funnel-by-Field/m-p/39301#M178780 martin_mueller 2013-05-20T08:21:54Z https://community.splunk.com/t5/Splunk-Search/Funnel-by-Field/m-p/39302#M178781 <P>Or the built-in command <CODE>accum</CODE> specifically for this purpose;</P> <P><CODE>... | accum count</CODE></P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Accum">http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Accum</A></P> <P>/K</P> Mon, 20 May 2013 08:39:22 GMT https://community.splunk.com/t5/Splunk-Search/Funnel-by-Field/m-p/39302#M178781 kristian_kolb 2013-05-20T08:39:22Z