Cumulative sum of hours

[shreeCS]

Hi,

I have created a chart showing the cumulative sum of hours for each host for the month of August.
Here the fields are

Day   Date   In-Time   Out-Time  DurationHours(OutTime-InTime)

The query is :

sourcetype="abc" | convert mstime(Out_Time__) AS outtime | convert mstime(In_Time__) AS intime |eval durationHrs=(outtime - intime )/60 | streamstats sum(durationHrs) as cumulativeSum by host | timechart values(cumulativeSum) by host

Here it should show ,for aug1 cumulative sum is 8,for Aug2 ->19 .... aug31-->208.
Here in my case it is in a reverse order i.e., for aug1 its showing 208 and for aug31 it is 8.How this can be solved?

Thank You

[somesoni2]

Please include "|sort date_mday" or "|sort _time" before performing streamstats.

[shreeCS]

Hi somesoni2,

thank you for the solution and i also come up with the solution where i included "reverse" in the query i.e., sourcetype="abc" | reverse |.....