Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Running Total
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am trying to get a running total for the number of events field. I can not get a column that adds up every 'number of events' or a running total anywhere at the bottom. Any Suggestions??
Heres my search:
*- fields + app_name, app_id |top app_id app_name |rename app_id AS "App Code" app_name AS "Application Name" count AS "Number of Events" percent AS "Percent"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
From the docs on accum:
accum
Keeps a running total of a specified numeric field.
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Accum
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
From the docs on accum:
accum
Keeps a running total of a specified numeric field.
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Accum
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Nice! Another command that I wasn't previously aware existed 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just as a suggestion, this search does a count for events with two distinct values, adds them together, and has the total as a new column.
| stats count(eval(product="abc")) AS abc_count, count(eval(product="xyz")) AS xyz_count by product | eval total_products=abc_count+xyz_count | sort -total_products
Sorry if this isn't what you're looking for, but hopefully it helps in some way.
Also you might want to remove the regex tag.. I don't think this has much to do with regular expressions 😉
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry about that, i am not sure how that got there.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
so there is no way to just add a field that will give me a running total for all the events that I am searching for. When i add the sum feature it just takes me to a different screen and then gives me a total instead of having all the information listed and totaling in a different field. Thank you for your help, just having a hard time getting it to work.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yes, but it does not add a seperate column that just has the total of all the counts
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
so you need to use a | stats sum(count) ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
They are existing fields, I need a total of the top events. Not just each individual event
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What about the part that generates the statistics? (the count and percent part) unless they are existing fields?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just a portion of it.. I left off the index and the sourcetype because i didnt think it would be needed.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
+1 Ayn, you'll need to copy and paste your whole search directly if you want any useful help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I doubt that is really your search. Did you paste the whole search or just portions of it?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
any help would be appreachated
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
