Splunk Search

How to create A new field which creates accumulative results from current and previous records of different field

priyaramki16
Path Finder

I have a two fields Calendar_week, Count...

I am trying to create a New field as Cumulative count which will add the previous cumulative count with Current Count.

For eg 

Calender_week----Count----Cumulative_Count

1                              ---- 0        ----0

2                              ---- 1       ----1

3                             ---- 2       ----3

 

Is there a search which could do this..

Thanks

Labels (2)
0 Karma
1 Solution

javiergn
Super Champion

Hi @priyaramki16 ,

 

Take a look at streamstats: 

https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/Streamstats

In your case, something like the following should do the trick:

 

your query here
| sort limit=0 "Calendar Week"
| streamstats sum(count) as Cumulative_Count

 

 

 

Hope that helps

View solution in original post

javiergn
Super Champion

Hi @priyaramki16 ,

 

Take a look at streamstats: 

https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/Streamstats

In your case, something like the following should do the trick:

 

your query here
| sort limit=0 "Calendar Week"
| streamstats sum(count) as Cumulative_Count

 

 

 

Hope that helps

priyaramki16
Path Finder

Hi @javiergn ...the query you suggested produced a field which is same as count but with first row not filled...

the addition did not happen

priyaramki16_0-1592303324342.png

 

0 Karma

javiergn
Super Champion

Hi @priyaramki16 ,

 

I made a typo on my answer as I didn't have a lab to check my syntax. See the answer above again.

By the way, make sure your sort is working fine as there seems to be a trailing space in your query between "Calendar" and "Week"

0 Karma

priyaramki16
Path Finder

Thanks!! It worked!!

0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...