i'd like to produce a field per event that's the running sum of some field as a percentage of the total sum of that field over the whole search.
for example, if this were excel, my sheet would look something like this:
i see that streamstats or accum can generate my "running total" column, but to get my "what i want" column, i need the output of stats c() or stats sum(), which destroys the individual events.
i feel like it might be a job for a sub-search and appendcols, but i haven't been able to work it out.
thanks in advance, orion
asked 03 Feb '12, 17:10