Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to calculate the "Moving" sum of the last 52 w...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunkers!
I have a new problem I'm not able to solve, I hope you can help me...
Basically, I'm counting the number of incidents occurring on weekly basis related to the last 2 years (events beginning in Jan 2016):
...
| eval dateweek_year=strftime(_time,"%Y-%U")
| chart count as Num_Incidents over dateweek_year
Now, I'd like to present the outcome as "moving sum" of the last 52 weeks, starting from Jan 2017.
So 01-2017 period has to show the sum of incidents from 02-2016 to 01-2017,
02-2017 from 03-2016 to 02-2017
etc...
Any help?
I've no clue about how to do it...
Eventstats/Streamstats should help?
Tks!
Carmine
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hey I think you want something like this
<your_base_search>
| eval dateweek_year=strftime(_time,"%Y-%U")
| chart count as Num_Incidents over dateweek_year
| streamstats sum(Num_Incidents) as "Moving_SUM" window=52
So, you will get cumulative sum of last 52 weeks at any point of time.
let me know if this helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hey I think you want something like this
<your_base_search>
| eval dateweek_year=strftime(_time,"%Y-%U")
| chart count as Num_Incidents over dateweek_year
| streamstats sum(Num_Incidents) as "Moving_SUM" window=52
So, you will get cumulative sum of last 52 weeks at any point of time.
let me know if this helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This option works, great 🙂
Tks!
Carmine
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@CarmineCalo, Please try the following and confirm
<YourBaseSearch>
| eval dateweek_year=strftime(_time,"%Y-%U")
| chart count as Num_Incidents over dateweek_year
| accum Num_Incidents
| makeresults | eval message= "Happy Splunking!!!"
A Season of Skills: New Splunk Courses to Light Up Your Learning Journey
Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...
Splunk Observability for AI
