Splunk Search

Accum statement

keyu921
Explorer

My data as following
Location|No.of active
US|200
UK|20
SZ|30

How to accum all those location by month by area chart
I now search as
w search as
|timechart span=1mon count by location| accum us as us| accum uk as uk | accum sz as sz | fields - uk us sz | fillnull

Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@keyu921

Can you please more about your requirement and expected output?

0 Karma

keyu921
Explorer

bar chart that no.active and trend grow for last1yrs timechart span=1month

0 Karma
Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...