Splunk Enterprise

How can I display a value cumulatively every hour?

Alexander17
Engager

How can I display a value cumulatively every hour?
For example 10:00 = 250 pieces, 11:00 = 200 pieces, 12:00 = 150 pieces.
The value should be displayed as follows

10:00 = 250 pieces
11:00 = 450 pieces
12:00 = 600 pieces

Which search command should I enter here?

Thanks in advance!

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @Alexander17,

I didn't notice "cumulative" 🙂

Please try below;

|timechart span=1h count as pieces | streamstats sum(pieces) as pieces
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @Alexander17,

I didn't notice "cumulative" 🙂

Please try below;

|timechart span=1h count as pieces | streamstats sum(pieces) as pieces
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

Alexander17
Engager

Perfect, it works!
Thank you very much and greetings from Germany!!!

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @Alexander17,

You can use timechart command like below sample;

| timechart span=1h count as pieces 
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

Alexander17
Engager

Hello scelikok,

Dankr for the quick reply! Unfortunately it does not work. The values are displayed per hour so

10:00 = 250 pieces
11:00 = 200 pieces
12:00 = 150 pieces.

But this is how it should be

10:00 = 250 pieces
11:00 = 450 pieces
12:00 = 600 pieces

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...