Add count of field instead of just count it

[indeed_2000]

Hi I have log file that each minute store 1 event like this

8:00   1

8:01   1

8:02   1

instead of counting i want store last value and add new value to that, like this:

8:48    2

8:49   12 (10+2)

8:50   20  (3+12)

8:51   21 (1+20)

…

any idea?

 Thanks 

[ITWhisperer]

| streamstats sum(count) as runningtotal

[venkatasri]

Hi @indeed_2000  You have to use streamstats command.

[venkatasri]

@indeed_2000 

You can try something like this, i assumed your field name for numerical as 'count' you have to change it for your case.

<your_search_goes_here>
| reverse 
| streamstats sum(count)

Output would be something like this,

---

An upvote would be appreciated and Accept solution if this reply helps!

[indeed_2000]

Field value is not number

field name= status (success,fail) 

Also i try these but not work:

index=main | reverse | streamstats sum(status)

index=main | reverse | streamstats sum(count(status))

any idea?

 Thanks 

[ITWhisperer]

Can you provide some sample events?

[indeed_2000]

I do field extraction that the name is “status”, and value is “fail” or “success”.

2021-07-06 23:11:12,197 INFO [app] fail , time[10] User: anonymous
2021-07-06 23:11:12,187 INFO [app] success, User: anonymous
2021-07-06 23:11:12,178 INFO [app] fail , time[10] User: anonymous
2021-07-06 23:11:12,167 INFO [app] success, User: anonymous
2021-07-06 23:11:12,159 INFO [app] fail , time[10] User: anonymous
2021-07-06 23:11:12,149 INFO [app] success, User: anonymous
2021-07-06 23:11:12,141 INFO [app] fail , time[10] User: anonymous
2021-07-06 23:11:12,131 INFO [app] success, User: anonymous
2021-07-06 23:11:12,134 INFO [app] success, User: anonymous
2021-07-06 23:11:12,138 INFO [app] success, User: anonymous

expected result:
fail 1
success 1
fail 2
success 2
fail 3
success 3
fail 4
success 4
success 5
success 6

[ITWhisperer]

Try this:

| streamstats count by status