Splunk Search

Accum statement

keyu921
Explorer

My data as following
Location|No.of active
US|200
UK|20
SZ|30

How to accum all those location by month by area chart
I now search as
w search as
|timechart span=1mon count by location| accum us as us| accum uk as uk | accum sz as sz | fields - uk us sz | fillnull

Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@keyu921

Can you please more about your requirement and expected output?

0 Karma

keyu921
Explorer

bar chart that no.active and trend grow for last1yrs timechart span=1month

0 Karma
Get Updates on the Splunk Community!

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...

Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation

As of Splunk Cloud Platform 9.3.2408 and Splunk Enterprise 9.4, classic dashboard export features are now ...