accum
This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6 , 4.0.7 , 4.0.8 , 4.0.9
accum
Synopsis
Keeps a running total of a specified numeric field.
Syntax
accum <field> [AS <newfield>]
Arguments
- field
- Syntax: <string>
- Description: The name of a field with numeric values.
- newfield
- Syntax: <string>
- Description: The name of a field to write the results to.
Description
For each event where field is a number, keep a running total of the sum of this number and write it out to either the same field, or a newfield if specified.
Examples
Example 1: Save the running total of "count" in a field called "total_count".
... | accum count AS total_count