Splunk Search

how to calculate growth total

dhavamanis
Builder

Can you please tell us, how to calculate growth total,

We have values like downloads_total for each week, but we want to show each week total growth with another one column values as over all total for the previous weeks,

 index="mobileappsdata" | stats sum(downloads) as total by week, app, brand

We need another one column like this,

 week, app, brand, total, overall_total
 week3,app1,brand1,10,30
 week3,app2,brand2,20,60
 week2,app1,brand1,10,20
 week2,app2,brand2,20,40
 week1,app1,brand1,10,10
 week1,app2,brand2,20,20
0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

Use streamstats (note the final sort and table are just to present the output in exactly the same format you used):

index="mobileappsdata" 
| stats sum(downloads) as total by week, app, brand
| sort week
| streamstats sum(total) as overall_total by app, brand
| table week ,app, brand, total, overall_total
| sort - week

View solution in original post

javiergn
SplunkTrust
SplunkTrust

Use streamstats (note the final sort and table are just to present the output in exactly the same format you used):

index="mobileappsdata" 
| stats sum(downloads) as total by week, app, brand
| sort week
| streamstats sum(total) as overall_total by app, brand
| table week ,app, brand, total, overall_total
| sort - week
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...