Splunk Search

How to add a field being a sum of previous rows?

tomaszwrona
Explorer

Hello,

i am looking to solve following problem.
How to calculate the fields summary_worked and summary_requested?

month hours_worked summary_worked hours_requested summary_requested
april 160 160 (hours worked for april) 160 160 (hours_requested for april)
may 160 320 (hours worked for april+may) 128 288 (hours_requested for april+may)
june 160 480 (hours worked for april+may+june) 188 476 (hours_requested for april+may+june)

Cheers
Tomasz

Tags (2)
0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

It sounds like you want a running total. You can do this with the splunk command accum.

You don't give any of your search, so I can only make a complete and total guess as to the search command you'll use, but it could be...

... your base search ... | accum hours_worked AS hours_worked_total | accum hours_requested AS hours_requested_total

Give that a try and see what it gets you. If you need more specific help, but sure to paste in your search and perhaps a few actual events (if the above aren't actual events).

View solution in original post

Richfez
SplunkTrust
SplunkTrust

It sounds like you want a running total. You can do this with the splunk command accum.

You don't give any of your search, so I can only make a complete and total guess as to the search command you'll use, but it could be...

... your base search ... | accum hours_worked AS hours_worked_total | accum hours_requested AS hours_requested_total

Give that a try and see what it gets you. If you need more specific help, but sure to paste in your search and perhaps a few actual events (if the above aren't actual events).

tomaszwrona
Explorer

hi,

this is exactly what i wanted to achieve - thank you!

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...