Related Answers
Download topic as PDF
accum
Description
For each event where field is a number, the accum command calculates a running total or sum of the numbers. The accumulated sum can be returned to either the same field, or a newfield that you specify.
Syntax
accum <field> [AS <newfield>]
Required arguments
- field
- Syntax: <string>
- Description: The name of the field that you want to calculate the accumulated sum for. The field must contain numeric values.
Optional arguments
- newfield
- Syntax: <string>
- Description: The name of a new field where you want the results placed.
Basic example
1. Create a running total of a field
| This example uses the sample data from the Search Tutorial but should work with any format of Apache web access log. To try this example on your own Splunk instance, you must download the sample data and follow the instructions to get the tutorial data into Splunk. Use the time range All time when you run the search. |
The following search looks for events from web access log files that were successful views of strategy games. A count of the events by each product ID is returned.
sourcetype=access_* status=200 categoryId=STRATEGY | chart count AS views by productId
The results appear on the Statistics tab and look something like this:
| productId | views |
|---|---|
| DB-SG-G01 | 1796 |
| DC-SG-G02 | 1642 |
| FS-SG-G03 | 1482 |
| PZ-SG-G05 | 1300 |
You can use the accum command to generate a running total of the views and display the running total in a new field called "TotalViews".
sourcetype=access_* status=200 categoryId=STRATEGY | chart count AS views by productId | accum views as TotalViews
The results appear on the Statistics tab and look something like this:
| productId | views | TotalViews |
|---|---|---|
| DB-SG-G01 | 1796 | 1796 |
| DC-SG-G02 | 1642 | 3438 |
| FS-SG-G03 | 1482 | 4920 |
| PZ-SG-G05 | 1300 | 6220 |
See also
autoregress, delta, streamstats, trendline
Answers
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the accum command.
|
PREVIOUS abstract |
NEXT addcoltotals |
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.10, 6.3.1, 6.6.9, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 7.0.1, 7.0.11, 7.0.13
Feedback submitted, thanks!