https://community.splunk.com/t5/Splunk-Search/Sum-of-new-events-over-time/m-p/183956#M52970 <P>Thank you! <BR /> That worked!</P> Mon, 24 Aug 2015 06:28:38 GMT liorfink 2015-08-24T06:28:38Z https://community.splunk.com/t5/Splunk-Search/Sum-of-new-events-over-time/m-p/183954#M52968 <P>Hi all!<BR /> I'm new to Splunk and I'm having trouble making my search correct.<BR /> I've tried searching but found no case exactly like mine.</P> <P>the problem:<BR /> I have a log with many 'Events', each event has a status: New/Old.<BR /> Old means it has been dealt with.<BR /> I would like to make a line-chart that will show the total number of new events over time.<BR /> My chart:<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/582iB3114762977268D8/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>The way the chart should look:<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/583i3D972643214187B1/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>This is what I've tried so far:<BR /> host="MyHost" Status="New" | timechart count(Status)<BR /> ... | timechart sum(Status)<BR /> ... | timechart sum(count(Status))</P> <P>Any help will be appreciated!<BR /> Thanks!</P> Sun, 23 Aug 2015 09:06:17 GMT https://community.splunk.com/t5/Splunk-Search/Sum-of-new-events-over-time/m-p/183954#M52968 liorfink 2015-08-23T09:06:17Z https://community.splunk.com/t5/Splunk-Search/Sum-of-new-events-over-time/m-p/183955#M52969 <P>This should do what you need:</P> <PRE><CODE>host="MyHost" Status="New" | timechart count | accum count </CODE></PRE> <P>That will turn the count per timeslot into a running total.</P> Sun, 23 Aug 2015 14:07:17 GMT https://community.splunk.com/t5/Splunk-Search/Sum-of-new-events-over-time/m-p/183955#M52969 martin_mueller 2015-08-23T14:07:17Z https://community.splunk.com/t5/Splunk-Search/Sum-of-new-events-over-time/m-p/183956#M52970 <P>Thank you! <BR /> That worked!</P> Mon, 24 Aug 2015 06:28:38 GMT https://community.splunk.com/t5/Splunk-Search/Sum-of-new-events-over-time/m-p/183956#M52970 liorfink 2015-08-24T06:28:38Z