Solved: Funnel by Field - Splunk Community

Splunk Search

... | table Field Count | sort 0 Field

For example, we have

Field	Count
n1	1
n2	10
n3	100
n4	1000

How can I make funnel like this?

Field	Count
n1	1
n2	11
n3	111
n4	1111

Value of Funnel is equal to sum of previous value of Funnel and current value of Count.

1 Solution

Solution

Append this:

... | streamstats sum(Count) as Count

View solution in original post

Or the built-in command accum specifically for this purpose;

... | accum count

http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Accum

/K

Solution

Append this:

... | streamstats sum(Count) as Count

Get Updates on the Splunk Community!

Supercharging Windows Security Detection Performance: Introducing Hybrid Field ...

Windows event logs—from Security auditing and Sysmon to PowerShell script blocks—form the operational backbone ...

Ditch the Manual Grind: Building AI Agents with Splunk

Ditch the Manual Grind: Building AI Agents with Splunk Let’s be real: your team’s time is being eaten alive. ...

Cisco Data Fabric from Architecture to Investigation, Better SOC Visibility, and More ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...