For each event where field is a number, the accum command in splunk calculates a running total or sum of the numbers. The accumulated sum can be returned to either the same field, or a new field that you specify.

Syntax for accum command in splunk:

accum <field> [AS <newfield>]

Query before using accum command:

index=* sourcetype="WinEventLog:*"
| stats count by LogName EventType
| fields - count

Result before using accum command:

Query after using accum command:

index=* sourcetype="WinEventLog:*"
| stats count by LogName EventType
| accum EventType as Total

Result after using accum command:

Explanation:

The Accum command is used to calculate the running total as data comes in, that is it takes the value in a new field and sums it with the recently camed value of the original field on which the calculation needs to be done and calculates the total.

In the above results we are calculating the EventType values by LogName further we are calculating the running total that is each row value is added with the values in the next rows and at the end the total is calculated in a new field.

Also look for Append Command in Splunk

If you are still facing issue regarding this topic Feel free to Ask Doubts in the Comment Box Below and Don’t Forget to Follow us on social platforms, happy Splunking >

The Power of Summary Indexing in Splunk

Renew Splunk Certificates

Exploring the Reverse Command in Splunk

Changing Splunk Web Port from 8000 to 443

Stats count to include zero count in splunk

Splunk Core Certified Power User Certification

Accum Command in Splunk

Understanding splunk accum command with an example

Syntax for accum command in splunk:

Query before using accum command:

Result before using accum command:

Query after using accum command:

Result after using accum command:

Explanation:

Also look for Append Command in Splunk

What do you think?

Exploring the Reverse Command in Splunk

Stats count to include zero count in splunk

Datamodel Command in Splunk

Dedup Command in Splunk

Bin Command Splunk

Addinfo Command in Splunk

The Power of Summary Indexing in Splunk

Exploring the Reverse Command in Splunk

Stats count to include zero count in splunk

Datamodel Command in Splunk

Dedup Command in Splunk

Bin Command Splunk

Leave a ReplyCancel reply

Changing Splunk Web Port from 8000 to 443

Configure Deployment Client Splunk

Renew Splunk Certificates

Datamodel Command in Splunk

Common Splunk Interview Questions

Appendcols Command in Splunk

Append Command in Splunk

Configure Deployment Client Splunk

Syntax for accum command in splunk:

Query before using accum command:

Result before using accum command:

Query after using accum command:

Result after using accum command:

Explanation:

Also look for Append Command in Splunk

What do you think?

Leave a ReplyCancel reply

Add to Collection

No Collections