top with running totals

[ytl]

i have events with two fields: origin and duration

i would like to present a table with the count of each origin, along with a running total of the duration - kinda like the output of top, but with the sum of the durations of each origin as another column.

[kristian_kolb · Accepted solution]

Perhaps this is what you want?

... | stats sum(duration), count by origin

If not, please provide a few sample events, and a simple sketch of the desired output

/K