Splunk Search

How to reset an accum command

billyp5
Engager

I am looking to create a timechart. I have a base search that adds or subtracts "1" when certain events occur:

eval x=if(match(field_1,"xxx"),1,-1)

Then I accumulate them with:

| accum x AS total_x |

The problem is that there is another type of event "event_y". When this type of event occurs, I need to reset "total_x" to 0 and have it start accumulating again. I've been trying:

eval reset=if(match(field_2,"event_y"),total_x=0,total_x)

And then using that to create a timechart

Any suggestions as to how I can make the accum reset?

Tags (2)

adityapavan18
Contributor

Its took me a while to come up with this. Please see if something like this helps

<pre search>  | eval x = if(match(field_1,"XXX"),1,if(match(field_1,"YYY"),0,-1))  | accum x AS total_x | table _time,field_1,x,total_x | eval y = if(x=0,total_x,NULL)  |filldown y | fillnull value=0 y | delta y as z | eval z = if(z=0,NULL,z) | eval w = coalesce(z,x) | eval w = if(x=0,0-w,w)| accum w as total_w

Here total_w column would be your requested re-setted accum count.

where XXX is where the we assume 1 is added and YYY is event where after the reset is required

0 Karma

TaylorWhitt
Path Finder

I don't know much about Splunk or how to write commands, but if your event_y fires, couldn't you multiply total_x by 0?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...