topic How to add a field being a sum of previous rows? in Splunk Search

How to add a field being a sum of previous rows?

tomaszwrona — Tue, 29 Sep 2020 09:56:36 GMT

Hello,

i am looking to solve following problem.
How to calculate the fields summary_worked and summary_requested?

month hours_worked summary_worked hours_requested summary_requested
april 160 160 (hours worked for april) 160 160 (hours_requested for april)
may 160 320 (hours worked for april+may) 128 288 (hours_requested for april+may)
june 160 480 (hours worked for april+may+june) 188 476 (hours_requested for april+may+june)

Cheers
Tomasz

Re: How to add a field being a sum of previous rows?

Richfez — Mon, 13 Jun 2016 11:46:42 GMT

It sounds like you want a running total. You can do this with the splunk command accum.

You don't give any of your search, so I can only make a complete and total guess as to the search command you'll use, but it could be...

... your base search ... | accum hours_worked AS hours_worked_total | accum hours_requested AS hours_requested_total

Give that a try and see what it gets you. If you need more specific help, but sure to paste in your search and perhaps a few actual events (if the above aren't actual events).

Re: How to add a field being a sum of previous rows?

tomaszwrona — Mon, 13 Jun 2016 11:59:53 GMT

hi,

this is exactly what i wanted to achieve - thank you!