You need to be comparing the sums up to that point, rather than the individual effort and work numbers. To know which sprint an item would be finished in, the net total work hours available must be the lowest number greater than the total effort required.
The obvious way to do this is with a cross join... which should be discouraged for large implementations...
Here's a run-anywhere sample to show you what we mean...
| makeresults
| fields - _time
| eval efforts="1 2 3 2 1 3 1 1 1 5"
| makemv efforts
| mvexpand efforts
| rename COMMENT as "The above produces the individual effort records"
| rename COMMENT as "This gives them each a record number, and creates a running total."
| streamstats count as eff_recno sum(efforts) as sumOfEfforts
| rename COMMENT as "Set a junk field to create a cross join."
| eval junk=1
| join junk max=1000 [
| makeresults
| eval workhours="5 3 3 6 2 2 2"
| makemv workhours
| mvexpand workhours
| rename COMMENT as "The above produces the individual work records"
| rename COMMENT as "This gives them each a record number, and creates a running total."
| streamstats count as work_recno sum(workhours) as sumOfWorkHours
| rename COMMENT as "Set a junk field to create a cross join."
| eval junk=1
]
| rename COMMENT as "Kill fields where the effort required is greater than the amount available."
| where sumOfEfforts<sumOfWorkHours
| rename COMMENT as "Accept only the first record where work is greater than the effort required."
| dedup eff_recno
... View more