|
i'd like to produce a field per event that's the running sum of some field as a percentage of the total sum of that field over the whole search. for example, if this were excel, my sheet would look something like this:
i see that streamstats or accum can generate my "running total" column, but to get my "what i want" column, i need the output of stats c() or stats sum(), which destroys the individual events. i feel like it might be a job for a sub-search and appendcols, but i haven't been able to work it out. thanks in advance, orion |