Note that with Splunk, there are often more ways to achieve the same goal. For example, you could use this instead of streamstats | accum gbu or | accum gbu as cum_gbu In the long run, streamstats is a more useful command (and takes more time to get your head around), as it supports split by clauses, whereas accum does not, so tends to be more useful.   ... View more