Splunk Search

Timechart: How to sum up all earlier values?

f_d
Engager

Hi, I want to create a timechart that shows the sum of all ealier values from another timechart.

As an example, I have a timechart as a base, like index=foo | timechart sum(field1). At t1 it has value 42, at t2 0 and at t3 -5.
The new timechart with the sum of all earlier values should show at t1 and t2 the value 42 and at t3 37.

How can that be achieved?

0 Karma
1 Solution

sundareshr
Legend

Try this

 index=foo | timechart sum(field1) as sum_fld1 | accum sum_fld1

View solution in original post

sundareshr
Legend

Try this

 index=foo | timechart sum(field1) as sum_fld1 | accum sum_fld1

f_d
Engager

Thanks. This works exactly as needed!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...