topic Re: Running Total in Splunk Search

Running Total

Michael_Schyma1 — Mon, 28 Sep 2020 12:01:45 GMT

I am trying to get a running total for the number of events field. I can not get a column that adds up every 'number of events' or a running total anywhere at the bottom. Any Suggestions??

Heres my search:

*- fields + app_name, app_id |top app_id app_name |rename app_id AS "App Code" app_name AS "Application Name" count AS "Number of Events" percent AS "Percent"

Re: Running Total

Michael_Schyma1 — Thu, 05 Jul 2012 13:02:20 GMT

any help would be appreachated

Re: Running Total

Ayn — Thu, 05 Jul 2012 13:07:55 GMT

I doubt that is really your search. Did you paste the whole search or just portions of it?

Re: Running Total

Drainy — Thu, 05 Jul 2012 13:10:36 GMT

+1 Ayn, you'll need to copy and paste your whole search directly if you want any useful help.

Re: Running Total

Michael_Schyma1 — Thu, 05 Jul 2012 14:06:03 GMT

Just a portion of it.. I left off the index and the sourcetype because i didnt think it would be needed.

Re: Running Total

Drainy — Thu, 05 Jul 2012 14:08:08 GMT

What about the part that generates the statistics? (the count and percent part) unless they are existing fields?

Re: Running Total

Michael_Schyma1 — Thu, 05 Jul 2012 14:10:01 GMT

They are existing fields, I need a total of the top events. Not just each individual event

Re: Running Total

Drainy — Thu, 05 Jul 2012 14:10:36 GMT

so you need to use a | stats sum(count) ?

Re: Running Total

Michael_Schyma1 — Thu, 05 Jul 2012 14:26:38 GMT

yes, but it does not add a seperate column that just has the total of all the counts

Re: Running Total

Michael_Schyma1 — Thu, 05 Jul 2012 14:30:58 GMT

so there is no way to just add a field that will give me a running total for all the events that I am searching for. When i add the sum feature it just takes me to a different screen and then gives me a total instead of having all the information listed and totaling in a different field. Thank you for your help, just having a hard time getting it to work.

Re: Running Total

rturk — Thu, 05 Jul 2012 15:22:37 GMT

Just as a suggestion, this search does a count for events with two distinct values, adds them together, and has the total as a new column.

 | stats count(eval(product="abc")) AS abc_count, count(eval(product="xyz")) AS xyz_count by product | eval total_products=abc_count+xyz_count  | sort -total_products

Sorry if this isn't what you're looking for, but hopefully it helps in some way.

Also you might want to remove the regex tag.. I don't think this has much to do with regular expressions 😉

Re: Running Total

Ayn — Thu, 05 Jul 2012 15:30:35 GMT

From the docs on accum:

accum
Keeps a running total of a specified numeric field.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Accum

Re: Running Total

Michael_Schyma1 — Thu, 05 Jul 2012 19:12:03 GMT

Sorry about that, i am not sure how that got there.

Re: Running Total

rturk — Thu, 05 Jul 2012 23:21:46 GMT

Nice! Another command that I wasn't previously aware existed 🙂