topic Re: Timechart - Running Total By Product in Splunk Search

Timechart - Running Total By Product

HeinzWaescher — Wed, 12 Feb 2014 10:07:35 GMT

Hi,

I would like to create a timechart that shows the running total revenues for each product.
First I've created a search for the overall running totals:

my search | bucket _time span=1d | stats sum(price) AS Revenues by _time | accum Revenues AS Total_Revenues | timechart last(Total_Revenues) span=1d

This seems to work fine. But now i don't know how to tell Splunk to do this for every product. The accum command does not allow a 'by product' argument.

Can someone help me with this search?

Heinz

Re: Timechart - Running Total By Product

somesoni2 — Wed, 12 Feb 2014 16:43:08 GMT

Try this

yours earch |  bucket _time span=1d | stats sum(price) AS Revenues by product,_time | streamstats sum(Revenues) as Total_Revenues by product| timechart span=1d last(Total_Revenues) by product

Re: Timechart - Running Total By Product

HeinzWaescher — Thu, 13 Feb 2014 11:09:45 GMT

hey,

thanks this works so far. At the moment there are some empty cells in the timechart, when there haven't been any revenues for a product on a specific day. So the accumulated values look like this at the moment:

Day 1 10$
Day 2 20$
Day 3 
Day 4 30$

Better would be:

Day 1 10$
Day 2 20$
Day 3 20$
Day 4 30$

Do you have an idea?

Re: Timechart - Running Total By Product

somesoni2 — Thu, 13 Feb 2014 17:50:59 GMT

Try this: This doesn't completely overcome the issue (as it will still show emtpy cell if, in your example, Day 1 or Day4 has no product. but anything in between it will fill in.

your search|  bucket _time span=1d | stats sum(duration) AS Revenues by product,_time | makecontinuous _time span=1d | eval joinfield=1 | join max=0 joinfield [search you search |  stats count by product | fields - count | eval joinfield=1] | fillnull   | streamstats sum(Revenues) as Total_Revenues by product | timechart span=1d last(Total_Revenues) by product

Re: Timechart - Running Total By Product

HeinzWaescher — Fri, 14 Feb 2014 15:31:49 GMT

This shows the overall revenues in every product column. I will use the first version. Thanks!

Re: Timechart - Running Total By Product

Vebloud — Fri, 22 Mar 2019 09:51:16 GMT

| fillnull comand will add nulls for missing values.