Accumulated sum with a dc value.

[sklass]

Hi all,

I have the following basic search - and I'm having trouble getting monthly accumulated plot of paths changed grouped change number. For reference a change number could have a number of distinct paths contained in it. Change numbers can happen anytime. If I have some source data

change     path      date      user
1001       /a/b     1-1-2001   bob
1002       /a/b     1-1-2001   joe
1002       /a/c     1-1-2001   joe
1002       /a/d     1-1-2001   joe
1002       /a/e     1-1-2001   joe
1003       /a/c     2-1-2001   jon
1003       /a/d     2-1-2001   jon
1004       /a/d     3-1-2001   bob

Now I know how to correctly group the data.

source=icm_data | stats dc(path) by change

This give me the right columns on how I want them initially lumped together.

change | dc(path)
1001         1
1002         5
1003         2
1004         1

Now what I want is a simple plot that shows x is the monthly number and T is the total

9      --    --    -T          
8      --    -T    --
7      --    --    --     
6      xT    --    -- 
5      --    --    --    
4      --    --    --     
3      --    --    --       
2      --    x-    --
1      --    --    x-    
0      --    --    --
 Mo   Jan   Feb   Mar

I'm aware of this answer - but I can't seem to get it to work with my dataset.

http://answers.splunk.com/answers/102444/cumulative-sum-in-splunk.html

[woodcock · Accepted solution]

Try this (I may have it backwards and you might have to change sort 0 - date to sort 0 date😞

source=icm_data | stats count AS CountBYDatePath BY date,path | sort 0 - date | streamstats sum(CountBYDatePath) AS accumulation by path