How to represent fluctuating values?

[pipipipi]

Hi all,

I have this search:

|table a b date
|eval c=a-b
|stats sum(*) as * by date date a b c
2019-01 5 3 2
2019-02 4 3 1
2019-03 3 2 1
2019-04 6 3 3

I want to make it like this:

Date d a b c

2019-01 0  5 3 2 
2019-02 2  4 3 3 
2019-03 3  3 2 4
2019-04 4  6 3 7

My formula is this:

a-b=c

Next month, I want to add c value, like this:

(c+a)-b=x
next month
(x+a)-b=y
(y+a)-b=z

......

I can understand this formula, but I can not express it in Splunk.
Do you have any ideas?

Thank you for helping.

[niketn]

@pipipipi check out the accum command in Splunk Documentation. You just need to add | accum c as d to your existing search. However, there can be some performance improvements (refer below):

   <yourSearchToFetchData>
  | fields a b date
  | stats sum(a) as a  sum(b) as b by date
  | eval c=a-b
  | accum c as d