How do I search a five day running total for values that exceed an amount?

[williamsonsteve]

I have 12 months of financial data where I am trying to extract the payees whose transaction totals for a sliding 5 day window exceeds 10,000.00.

The data is structured
datetime payee amount
01/03/2011 10:28:58 GARY SMITH 875.01

etc...

I've tried
| bucket _time span=1d
| streamstats sum(amount) as TotalAmount, count(remitter) as PayeeChecks window=5 by _time,payee
| chart sum(TotalAmount) sum(PayeeChecks) by payee

No joy...
Looking for guidance on how to approach this.

[woodcock]

Try this:

... | bucket _time span=1d |stats sum(amount) AS DailyAmount, count(remitter) AS PayeeChecks BY _time,payee | streamtstats window=5 sum(DailyAmount) AS AmountLast5Days, sum(PayeeChecks) AS PayeeChecksLast5Days BY payee