Why am I unable to get a running total using the streamstats command in my search?

[ra01]

When I try the search to create a running total out of the streamstats documentation, it doesn't work. Nothing changes when I add/remove the streamstats part at the end:

For reference:

... | timechart span=1h sum(value) as total by category | streamstats global=f sum(total) as accu_total

http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/streamstats

When I try:

| transaction uid mvlist=f keepevicted=t maxpause=5m
| eval didco = if(match(url, "/checkout/order"), 1, 0 ) 
| timechart span=15m sum(didco) as total  by experienceId_1
| streamstats global=f sum(total) as accu_total

I get the same result if I add/remove the streamstats line. I get rows with each time break, and two columns for the two different "experienceId_1" values, but no running total.

---

UPDATE: When I try running this without doing the 'transaction' it runs ok, so it seems like something about the transaction command is not going good.

[somesoni2 · Accepted solution]

After timechart command, there is no field named total (only field available will be _time and one field for each value of category)
Try this instead.

your base search | timechart span=1h sum(value) as total by category | streamstats global=f sum(*) as accu_total_*

OR

  your base search | timechart span=1h sum(value) as total by category | addtotals | accum Total | rename Total as accu_total

[ra01]

that works, but why doesn't the example from the documentation work? The sum(total) bit that you changed is right out of the documentation page.

How'd i get that wrong?

btw, thanks so much for helping me fix this.

[somesoni2]

It seems to be documentation's example is incorrect. I've left the comments there for the moderator to see and take action.

[ra01]

thanks. I spent way too long trying to figure out what i was doing wrong between the docs and my search string.