I have count of VMs per month and I want to show the count increment in a new column, for ex
_time Monthly count
2014-06 49
2014-07 300
2014-08 5
2014-09 97
I want to show the incremental sum in a new column as this -
_time Monthly count Incremental Sum
2014-06 49 49
2014-07 300 349
2014-08 5 354
2014-09 97 471
please check "accum" command -
For each event where field is a number, the accum command calculates a running total or sum of the numbers. The accumulated sum can be returned to either the same field, or a newfield that you specify.
http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/accum
your search here | accum count as IncrementalSum
Try this
your current search | eval Commulative_sum='Monthly count' | accum Commulative_sum
OR
your current search | streamstats sum("Monthly count") as "Commulative Sum"