Splunk Search

Why am I unable to get a running total using the streamstats command in my search?

ra01
Path Finder

When I try the search to create a running total out of the streamstats documentation, it doesn't work. Nothing changes when I add/remove the streamstats part at the end:

For reference:

... | timechart span=1h sum(value) as total by category | streamstats global=f sum(total) as accu_total

http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/streamstats

When I try:

| transaction uid mvlist=f keepevicted=t maxpause=5m
| eval didco = if(match(url, "/checkout/order"), 1, 0 ) 
| timechart span=15m sum(didco) as total  by experienceId_1
| streamstats global=f sum(total) as accu_total

I get the same result if I add/remove the streamstats line. I get rows with each time break, and two columns for the two different "experienceId_1" values, but no running total.


UPDATE: When I try running this without doing the 'transaction' it runs ok, so it seems like something about the transaction command is not going good.

0 Karma
1 Solution

somesoni2
Revered Legend

After timechart command, there is no field named total (only field available will be _time and one field for each value of category)
Try this instead.

your base search | timechart span=1h sum(value) as total by category | streamstats global=f sum(*) as accu_total_*

OR

  your base search | timechart span=1h sum(value) as total by category | addtotals | accum Total | rename Total as accu_total

View solution in original post

somesoni2
Revered Legend

After timechart command, there is no field named total (only field available will be _time and one field for each value of category)
Try this instead.

your base search | timechart span=1h sum(value) as total by category | streamstats global=f sum(*) as accu_total_*

OR

  your base search | timechart span=1h sum(value) as total by category | addtotals | accum Total | rename Total as accu_total

ra01
Path Finder

that works, but why doesn't the example from the documentation work? The sum(total) bit that you changed is right out of the documentation page.

How'd i get that wrong?

btw, thanks so much for helping me fix this.

0 Karma

somesoni2
Revered Legend

It seems to be documentation's example is incorrect. I've left the comments there for the moderator to see and take action.

0 Karma

ra01
Path Finder

thanks. I spent way too long trying to figure out what i was doing wrong between the docs and my search string.

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...