Splunk Search

How do I calculate Accumulation for all fields in a timechart

RubenF
Engager

Hi,

I have a timechart with the revenue of several shops (each shop is a field) over the month. I want to know the accumulate revenue of each shop over time so that if a shop earned 5$ on monday and 7$ on tuesday then on tuesday the graph will show 12$. 

I know that the command accum does that for a given field but I don't know ahead how many fields there will be.

Example:

A   B    C                A    B    C
8   3    5       ->       8    3    5
6   7    4                14   10   9
2   5    9                16   15   18

 

This is my code until now:

<something>
| timechart span=1d sum(revenue) by shop
| accum A | accum B | accum C

 

The goal is for the fields to be dynamic and not hardcoded!

Thank you

Labels (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

Use streamstats with sum() aggregation.

Example:

| makeresults count=10 
| eval a=1,b=2,c=3
| streamstats sum(*) as sum*

 

View solution in original post

0 Karma

RubenF
Engager

Works perfectly! Thank you

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Use streamstats with sum() aggregation.

Example:

| makeresults count=10 
| eval a=1,b=2,c=3
| streamstats sum(*) as sum*

 

0 Karma
Get Updates on the Splunk Community!

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...