Splunk Search

How do I calculate Accumulation for all fields in a timechart

RubenF
Engager

Hi,

I have a timechart with the revenue of several shops (each shop is a field) over the month. I want to know the accumulate revenue of each shop over time so that if a shop earned 5$ on monday and 7$ on tuesday then on tuesday the graph will show 12$. 

I know that the command accum does that for a given field but I don't know ahead how many fields there will be.

Example:

A   B    C                A    B    C
8   3    5       ->       8    3    5
6   7    4                14   10   9
2   5    9                16   15   18

 

This is my code until now:

<something>
| timechart span=1d sum(revenue) by shop
| accum A | accum B | accum C

 

The goal is for the fields to be dynamic and not hardcoded!

Thank you

Labels (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

Use streamstats with sum() aggregation.

Example:

| makeresults count=10 
| eval a=1,b=2,c=3
| streamstats sum(*) as sum*

 

View solution in original post

0 Karma

RubenF
Engager

Works perfectly! Thank you

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Use streamstats with sum() aggregation.

Example:

| makeresults count=10 
| eval a=1,b=2,c=3
| streamstats sum(*) as sum*

 

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...