Archive
Highlighted

## accum command examples

Motivator

Could anyone please provide the example to learn the accum command.
i never used this command so i need some example to learn.

Tags (2)
1 Solution
Highlighted

## Re: accum command examples

SplunkTrust

Hi @logloganathan,

The accum command calculates a running total or sum of the numbers. The accumulated sum can be returned to either the same field, or a newfield that you specify.

See this example:

``````| gentimes start=1 end=10 | eval sr_no=1 | accum sr_no | table sr_no

| gentimes start=1 end=10 | eval sr_no=2 | accum sr_no | table sr_no

| gentimes start=1 end=10 | eval sr_no=3 | accum sr_no as NO  | table sr_no NO
``````

https://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Accum

Highlighted

## Re: accum command examples

Champion

The `accum` command calculates a running total of the values in a specified field. Here's a very short run-anywhere example:

``````| makeresults
| eval a=5
| append
[| makeresults
| eval a=1 ]
| append
[| makeresults
| eval a=7 ]
| accum a AS b
``````

This will create a table with the _time that the events were generated, the field `a` (which is assigned the values 5, 1, and 7) and the field `b` (which contains a running total of the values from field `a`: 5, 6, 13). If you don't specify the `AS` clause, the accum command will store the running total in the source field:

``````| makeresults
| eval a=5
| append
[| makeresults
| eval a=1 ]
| append
[| makeresults
| eval a=7 ]
| accum a
``````

This will just give you a table with the _time field and the field `a`, which no longer contains the original source values but only the running total of the source values.

Highlighted

## Re: accum command examples

Motivator

wow...very detailed explanation

Highlighted

## Re: accum command examples

Legend

You should read splunk documentation on accum command:

Try the following run anywhere search based on your Splunk's _internal index

``````index=_internal sourcetype=splunkd log_level!="INFO"
| stats count as Total by component
| accum Total as cumulativeTotal
``````

You can use accum command for generating serial number for number of results displayed in a table

``````index=_internal sourcetype=splunkd log_level!="INFO"
| stats count as Total by component
| eval sno=1
| accum sno
``````

You can also learn streamstats command which can perform the operation of accum command and much more. Also Similar to how accum command performs cumulative total of specific field in streaming manner, delta command can give you cumulative difference, so read about that as well.

| eval message="Happy Splunking!!!"