Splunk Search

How do I calculate Accumulation for all fields in a timechart

RubenF
Engager

Hi,

I have a timechart with the revenue of several shops (each shop is a field) over the month. I want to know the accumulate revenue of each shop over time so that if a shop earned 5$ on monday and 7$ on tuesday then on tuesday the graph will show 12$. 

I know that the command accum does that for a given field but I don't know ahead how many fields there will be.

Example:

A   B    C                A    B    C
8   3    5       ->       8    3    5
6   7    4                14   10   9
2   5    9                16   15   18

 

This is my code until now:

<something>
| timechart span=1d sum(revenue) by shop
| accum A | accum B | accum C

 

The goal is for the fields to be dynamic and not hardcoded!

Thank you

Labels (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

Use streamstats with sum() aggregation.

Example:

| makeresults count=10 
| eval a=1,b=2,c=3
| streamstats sum(*) as sum*

 

View solution in original post

0 Karma

RubenF
Engager

Works perfectly! Thank you

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Use streamstats with sum() aggregation.

Example:

| makeresults count=10 
| eval a=1,b=2,c=3
| streamstats sum(*) as sum*

 

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...