accum
Use the accum command to compute a running cumulative sum
of a numeric field.
Syntax
| accumfield[ASout]
The command uses the following arguments:
-
field -
AS(Optional) – An alias for the output field.out
Example
The following query computes a running total of bytes.
fields @timestamp, bytes | accum bytes AS totalBytes
