Splunk Search

Set limit to Accum value

weihtee
New Member

I have a list of +1 and -1 that I would like to sum them up as events happen, but I do not want the sum to go below 0. If the current sum is 0 and the new variable is -1, it will simply remain at 0. Any idea how to do this?
Eg.
n sum
1 1
-1 0
-1 0
-1 0
1 1
1 2
-1 1
Thank you

Tags (1)
0 Karma
1 Solution

rakesh_498115
Motivator

Hi Weihtee,

You can use the where condition to emlinate counting those -1's like below,

[your search] | where n > 0 | accum n as sum | table n,sum

Hope this Helps !!

View solution in original post

rakesh_498115
Motivator

Hi Weihtee,

You can use the where condition to emlinate counting those -1's like below,

[your search] | where n > 0 | accum n as sum | table n,sum

Hope this Helps !!

rakesh_498115
Motivator

ok..in the case a simple eval statement would do the trick for u.

[your search] | accum n as sum | eval sum = if(sum<0,0,sum) | table n,sum

this will not let sum below 0 🙂

weihtee
New Member

Hi thanks, but I need the -1's since if the sum is any number above 0, it is still useful( eg 4, it would get the sum to 4-1=3)
I just need the sum to not go below 0 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...