topic Re: Set limit to Accum value in Splunk Search

Set limit to Accum value

weihtee — Wed, 12 Mar 2014 04:36:13 GMT

I have a list of +1 and -1 that I would like to sum them up as events happen, but I do not want the sum to go below 0. If the current sum is 0 and the new variable is -1, it will simply remain at 0. Any idea how to do this?
Eg.
n sum
1 1
-1 0
-1 0
-1 0
1 1
1 2
-1 1
Thank you

Re: Set limit to Accum value

rakesh_498115 — Wed, 12 Mar 2014 07:18:05 GMT

Hi Weihtee,

You can use the where condition to emlinate counting those -1's like below,

[your search] | where n > 0 | accum n as sum | table n,sum

Hope this Helps !!

Re: Set limit to Accum value

weihtee — Wed, 12 Mar 2014 07:34:29 GMT

Hi thanks, but I need the -1's since if the sum is any number above 0, it is still useful( eg 4, it would get the sum to 4-1=3)
I just need the sum to not go below 0 🙂

Re: Set limit to Accum value

rakesh_498115 — Wed, 12 Mar 2014 11:46:18 GMT

ok..in the case a simple eval statement would do the trick for u.

[your search] | accum n as sum | eval sum = if(sum<0,0,sum) | table n,sum

this will not let sum below 0 🙂