How to calculate (total or YTD/year-to-date) accumulated count based on region (or other group)

[kalitbri]

How to calculate (total or YTD/year-to-date) accumulated count based on region (or other group) in a search request? Like the last 2 field in following example data:

http://paste.plurk.com/show/268913/

[gkanapathy · Accepted solution]

the streamstats command:

... | bucket _time span=1mon | stats count by _time,region | streamstats global=f current=t sum(count) as cum_count by _time,region

I don't know how to do YTD.

[kalitbri]

I tested but only works after i removed _time from by-clause in streamstats. Thanks anyway! I can achieve YTD similarly, by:

... | eval _year=_time | bucket _time span=1mon | bucket _year span=1year | stats count by _time,region | streamstats global=f current=t sum(count) as ytd_count by region,_year | fields _time,region,ytd_count

[kalitbri]

Thanks! how about similar way , but by _time@Y for YTD?