Related Answers
Download topic as PDF
accum
Description
For each event where field is a number, the accum command calculates a running total or sum of the numbers. The accumulated sum can be returned to either the same field, or a newfield that you specify.
Syntax
accum <field> [AS <newfield>]
Required arguments
- field
- Syntax: <string>
- Description: The name of the field that you want to calculate the accumulated sum for. The field must contain numeric values.
Optional arguments
- newfield
- Syntax: <string>
- Description: The name of a new field where you want the results placed.
Examples
Example 1:
Save the running total of the quantity field into a new field called "total_quantity".
... | accum quantity AS total_quantity
See also
autoregress, delta, streamstats, trendline
Answers
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the accum command.
|
PREVIOUS abstract |
NEXT addcoltotals |
This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.5, 6.4.10, 6.4.11, 6.0.1, 6.4.4, 6.4.9, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.3.0, 7.3.1, 7.3.2, 6.4.6, 6.4.7, 6.4.8
Comments
This command *REALLY* needs a "BY" option (like stats).
Woodcock - It is the same without the reverse command.
I assume that your example is the same as doing this, right?
... | reverse | streamstats current=t sum(quantity) AS total_quantity
Woodcock
Thank you for the suggestion. I will pass it along to the engineering team.