Help with streamstats by for cumulative totals

[Mike_Mulcock]

Looking to create a dashboard showing cumulative totals of events for the past hour, broken down into 1 minuet periods, for each specific event. The below search shows the events per hour, but no cumulative totals:

<search query>| dedup ip, Event| timechart count as total span=1m by Event

This works fine and I am able to produce the line graph, 1 line per event, show the count of occurrences per period.

To make this cumulative, I have tried using the following:

<search query>| dedup ip, Event| timechart count as total span=1m by Event | streamstats sum(total) by Event

This returns the same graph as the first query. If I remove the "By Event" from the timechart string, I get a graph with a single line (labelled total), plotting the sum of all of the events for each time period, still no cumulative totals..

I'm sure the issue lies in the way I'm using streamstats, so any pointers would be much appreciated 🙂

[nabeel652 · Accepted solution]

This search will give you a cumulative sum over time time. This search can help you changing the fields according to your's.

index=_internal sourcetype!=splunkd earliest="-15m" latest=now | timechart span=1m count by sourcetype | untable _time sourcetype count | streamstats sum(count) as count by sourcetype | xyseries _time sourcetype count

[Mike_Mulcock]

Perfect thanks!