Splunk Search

Timechart value every hour + cumulative line

balash1979
Path Finder

I got the query that shows count every hour using timechart command 

    <<my query>> | timechart span=1h count(path) 

What I would like is to show both count per hour and cumulative value (basically adding up the count per hour)
How can I show the count per hour as column chart but the cumulative value as a line chart ?

--Sunray

Labels (1)
0 Karma
1 Solution

saravanan90
Contributor

This can help..

    <<my query>> | timechart span=1h count(path) | streamstats sum(count) as cumulative_data

View solution in original post

saravanan90
Contributor

This can help..

    <<my query>> | timechart span=1h count(path) | streamstats sum(count) as cumulative_data

Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...