Splunk Search

Streamstats count

pranaynanda
Path Finder

I want a cumulative count of a field that has multiple values. Somehow this isn't working:

base search| streamstats count(State) as dur time_window=1w| timechart sum(dur) by State span=1w
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try this (always have span just after timechart command)

base search| timechart span=1w count by State |  streamstats sum(*) as *

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try this (always have span just after timechart command)

base search| timechart span=1w count by State |  streamstats sum(*) as *

pranaynanda
Path Finder

Voila! You're there! Thanks! I expect some admin to convert your comment to the answer! Amazing job! Thank you.

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

And the community expects you to accept the answer, please. 😉

woodcock
Esteemed Legend

Please explain your use case (your desired ending dataset).

0 Karma

pranaynanda
Path Finder

something like this does solve my problem as @somesoni2 suggested but I would like to see data split into weeks instead of months:

 base search| timechart count by State span=1w |  streamstats sum(*) as *
0 Karma

somesoni2
SplunkTrust
SplunkTrust

How about this?

base search| timechart count by State span=1w |  streamstats sum(*) as *

pranaynanda
Path Finder

this pretty much solves it except that I see the results split into months instead of weeks as desired.

0 Karma

cmerriman
Super Champion

can you give some example data and expected results? a few more details might make this easier to answer, thanks 🙂

you might need to sort your events before your streamstats since you're doing a time_window.

0 Karma

pranaynanda
Path Finder

something like this does solve my problem as @somesoni2 suggested but I would like to see data split into weeks instead of months:

 base search| timechart count by State span=1w |  streamstats sum(*) as *
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...