https://community.splunk.com/t5/Splunk-Search/How-to-search-the-cumulative-sum-for-multiple-fields-and-chart/m-p/183985#M52979 <P>Hi,</P> <P>Try with</P> <PRE><CODE>....| streamstats sum(AWS-*) as AWS-*_accum |timechart AWS-*_accum span=1d </CODE></PRE> Tue, 30 Jun 2015 13:38:05 GMT ngatchasandra 2015-06-30T13:38:05Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-cumulative-sum-for-multiple-fields-and-chart/m-p/183981#M52975 <P>Hello</P> <P>I am trying to get a cumulative sum of multiple fields and then chart them. Problem is, I can use accum on only ONE field at a time. The fields are dynamic, so I need something which will calculate the cumulative value for fields which start with AWS-* </P> <P>The fields look like below<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/439i37E9BC4C5C69FB16/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>There can be other tags too like AWS-S3 etc depending on the filters which people pick. So Is there a way to get a cumulative value of each field as its own field ( cumulative value of AWs-EC2 as accum _AWS-EC2etc) ?</P> <P>Search:</P> <PRE><CODE> index=blah sourcetype=blah source="*blah-*" Center=ABC123|timechart span=1d sum(UnBlendedCost) as Cost by ProductName_Tag|accum AWS-EC2 as accum_AWS-EC2|accum AWS-EMR as accum_AWS-EMR </CODE></PRE> <P>UPDATE: Updated the question. I am trying to get the cumulative value by Day </P> Tue, 30 Jun 2015 13:00:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-cumulative-sum-for-multiple-fields-and-chart/m-p/183981#M52975 theouhuios 2015-06-30T13:00:23Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-cumulative-sum-for-multiple-fields-and-chart/m-p/183982#M52976 <P>Try this:</P> <PRE><CODE>... | streamstats sum(AWS-*) </CODE></PRE> <P>or this:</P> <PRE><CODE>... | stats sum(AWS-*) </CODE></PRE> Tue, 30 Jun 2015 13:20:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-cumulative-sum-for-multiple-fields-and-chart/m-p/183982#M52976 woodcock 2015-06-30T13:20:44Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-cumulative-sum-for-multiple-fields-and-chart/m-p/183983#M52977 <P>Sorry, I should have been more Clear. I need to get a cumulative value by each day so that I can just chart the cumulative values of all AWS-* , stack them up which would give the total value for the day along with the ProductName.</P> Tue, 30 Jun 2015 13:30:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-cumulative-sum-for-multiple-fields-and-chart/m-p/183983#M52977 theouhuios 2015-06-30T13:30:11Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-cumulative-sum-for-multiple-fields-and-chart/m-p/183984#M52978 <P>What search command are you currently using ? </P> Tue, 30 Jun 2015 13:34:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-cumulative-sum-for-multiple-fields-and-chart/m-p/183984#M52978 DavidHourani 2015-06-30T13:34:41Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-cumulative-sum-for-multiple-fields-and-chart/m-p/183985#M52979 <P>Hi,</P> <P>Try with</P> <PRE><CODE>....| streamstats sum(AWS-*) as AWS-*_accum |timechart AWS-*_accum span=1d </CODE></PRE> Tue, 30 Jun 2015 13:38:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-cumulative-sum-for-multiple-fields-and-chart/m-p/183985#M52979 ngatchasandra 2015-06-30T13:38:05Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-cumulative-sum-for-multiple-fields-and-chart/m-p/183986#M52980 <P>OK, based on your clarification, do this:</P> <PRE><CODE>... | bucket _time span=1d | stats sum(AWS-*) by _time | addcoltotals </CODE></PRE> <P>Or this (still not sure if you need accum or sum):</P> <PRE><CODE>... | bucket _time span=1d | streamstats sum(AWS-*) by _time </CODE></PRE> <P>The <CODE>bucket</CODE> part may not be necessary (if your data matches what you show).</P> Tue, 30 Jun 2015 13:40:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-cumulative-sum-for-multiple-fields-and-chart/m-p/183986#M52980 woodcock 2015-06-30T13:40:13Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-cumulative-sum-for-multiple-fields-and-chart/m-p/183987#M52981 <P>Updated the search</P> Tue, 30 Jun 2015 13:42:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-cumulative-sum-for-multiple-fields-and-chart/m-p/183987#M52981 theouhuios 2015-06-30T13:42:53Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-cumulative-sum-for-multiple-fields-and-chart/m-p/183988#M52982 <P>try like:</P> <P>...| bucket _time span=1d |streamstats sum(AWS-*) by _time |</P> Tue, 30 Jun 2015 13:46:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-cumulative-sum-for-multiple-fields-and-chart/m-p/183988#M52982 fdi01 2015-06-30T13:46:40Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-cumulative-sum-for-multiple-fields-and-chart/m-p/183989#M52983 <P>Updated the question with the search. AWs-* field are basically values of field called ProductName. </P> Tue, 30 Jun 2015 13:46:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-cumulative-sum-for-multiple-fields-and-chart/m-p/183989#M52983 theouhuios 2015-06-30T13:46:54Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-cumulative-sum-for-multiple-fields-and-chart/m-p/183990#M52984 <P>Try also with accum command which create a cumulative sum:</P> <PRE><CODE> ....| accum sum AWS-* as AWS-*_accum |timechart AWS-*_accum span=1d </CODE></PRE> Tue, 30 Jun 2015 13:49:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-cumulative-sum-for-multiple-fields-and-chart/m-p/183990#M52984 ngatchasandra 2015-06-30T13:49:56Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-cumulative-sum-for-multiple-fields-and-chart/m-p/183991#M52985 <P>This wouldn't work . If I do it after the timechart it would give me the same value since at a given _time value there is only one corresponding AWS-EC2 or AWS-EMR value. If I do this before my timechart, there is no field called AWS-*</P> Tue, 30 Jun 2015 13:51:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-cumulative-sum-for-multiple-fields-and-chart/m-p/183991#M52985 theouhuios 2015-06-30T13:51:23Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-cumulative-sum-for-multiple-fields-and-chart/m-p/183992#M52986 <P>addcoltotals will give me a cumulative value for all the fields.. Problem is I need it to add by day.. Like accum which keeps adding the field above the the current field and keeps going on. This would basically give me the TOTAL cost till that day, for everyday.</P> Tue, 30 Jun 2015 13:55:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-cumulative-sum-for-multiple-fields-and-chart/m-p/183992#M52986 theouhuios 2015-06-30T13:55:22Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-cumulative-sum-for-multiple-fields-and-chart/m-p/183993#M52987 <P>Amazing. Such a simple function and it solved the issue. </P> Tue, 30 Jun 2015 14:00:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-cumulative-sum-for-multiple-fields-and-chart/m-p/183993#M52987 theouhuios 2015-06-30T14:00:47Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-cumulative-sum-for-multiple-fields-and-chart/m-p/183994#M52988 <P>This will work:</P> <PRE><CODE> index=blah sourcetype=blah source="*blah-*" Center=ABC123|timechart span=1d sum(UnBlendedCost) as Cost by ProductName_Tag | reverse | streamstats current=t sum(AWS*) BY _time </CODE></PRE> <P>But I think you are not looking for a running total (which is what <CODE>accum</CODE> and <CODE>streamstats</CODE> do) but rather a daily sum, right? If so then do this:</P> <PRE><CODE> index=blah sourcetype=blah source="*blah-*" Center=ABC123|timechart span=1d sum(UnBlendedCost) as Cost by ProductName_Tag | reverse | stats sum(AWS*) BY _time </CODE></PRE> <P>Or, to keep the table as-is and just add a column, do this</P> <PRE><CODE> index=blah sourcetype=blah source="*blah-*" Center=ABC123|timechart span=1d sum(UnBlendedCost) as Cost by ProductName_Tag | reverse | eventstats sum(AWS*) BY _time </CODE></PRE> Tue, 30 Jun 2015 14:32:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-cumulative-sum-for-multiple-fields-and-chart/m-p/183994#M52988 woodcock 2015-06-30T14:32:42Z