Splunk Search

Set limit to Accum value

weihtee
New Member

I have a list of +1 and -1 that I would like to sum them up as events happen, but I do not want the sum to go below 0. If the current sum is 0 and the new variable is -1, it will simply remain at 0. Any idea how to do this?
Eg.
n sum
1 1
-1 0
-1 0
-1 0
1 1
1 2
-1 1
Thank you

Tags (1)
0 Karma
1 Solution

rakesh_498115
Motivator

Hi Weihtee,

You can use the where condition to emlinate counting those -1's like below,

[your search] | where n > 0 | accum n as sum | table n,sum

Hope this Helps !!

View solution in original post

rakesh_498115
Motivator

Hi Weihtee,

You can use the where condition to emlinate counting those -1's like below,

[your search] | where n > 0 | accum n as sum | table n,sum

Hope this Helps !!

rakesh_498115
Motivator

ok..in the case a simple eval statement would do the trick for u.

[your search] | accum n as sum | eval sum = if(sum<0,0,sum) | table n,sum

this will not let sum below 0 🙂

weihtee
New Member

Hi thanks, but I need the -1's since if the sum is any number above 0, it is still useful( eg 4, it would get the sum to 4-1=3)
I just need the sum to not go below 0 🙂

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...