Splunk Search

How to calculate (total or YTD/year-to-date) accumulated count based on region (or other group)

Explorer

How to calculate (total or YTD/year-to-date) accumulated count based on region (or other group) in a search request? Like the last 2 field in following example data:

http://paste.plurk.com/show/268913/

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

the streamstats command:

... | bucket _time span=1mon | stats count by _time,region | streamstats global=f current=t sum(count) as cum_count by _time,region

I don't know how to do YTD.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

the streamstats command:

... | bucket _time span=1mon | stats count by _time,region | streamstats global=f current=t sum(count) as cum_count by _time,region

I don't know how to do YTD.

View solution in original post

0 Karma

Explorer

I tested but only works after i removed _time from by-clause in streamstats. Thanks anyway! I can achieve YTD similarly, by:

... | eval _year=_time | bucket _time span=1mon | bucket _year span=1year | stats count by _time,region | streamstats global=f current=t sum(count) as ytd_count by region,_year | fields _time,region,ytd_count

0 Karma

Explorer

Thanks! how about similar way , but by _time@Y for YTD?

0 Karma