Splunk Search

How to calculate the "Moving" sum of the last 52 weeks?

CarmineCalo
Path Finder

Splunkers!
I have a new problem I'm not able to solve, I hope you can help me...

Basically, I'm counting the number of incidents occurring on weekly basis related to the last 2 years (events beginning in Jan 2016):

...
| eval dateweek_year=strftime(_time,"%Y-%U")    
| chart count as Num_Incidents over dateweek_year

Now, I'd like to present the outcome as "moving sum" of the last 52 weeks, starting from Jan 2017.
So 01-2017 period has to show the sum of incidents from 02-2016 to 01-2017,
02-2017 from 03-2016 to 02-2017
etc...

Any help?

I've no clue about how to do it...

Eventstats/Streamstats should help?

Tks!
Carmine

0 Karma
1 Solution

mayurr98
Super Champion

hey I think you want something like this

<your_base_search> 
| eval dateweek_year=strftime(_time,"%Y-%U") 
| chart count as Num_Incidents over dateweek_year 
| streamstats sum(Num_Incidents) as "Moving_SUM" window=52

So, you will get cumulative sum of last 52 weeks at any point of time.
let me know if this helps!

View solution in original post

0 Karma

mayurr98
Super Champion

hey I think you want something like this

<your_base_search> 
| eval dateweek_year=strftime(_time,"%Y-%U") 
| chart count as Num_Incidents over dateweek_year 
| streamstats sum(Num_Incidents) as "Moving_SUM" window=52

So, you will get cumulative sum of last 52 weeks at any point of time.
let me know if this helps!

0 Karma

CarmineCalo
Path Finder

This option works, great :slightly_smiling_face:

Tks!
Carmine

0 Karma

niketn
Legend

@CarmineCalo, Please try the following and confirm

 <YourBaseSearch>
| eval dateweek_year=strftime(_time,"%Y-%U")    
| chart count as Num_Incidents over dateweek_year
| accum Num_Incidents 
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...