Yes. Always think in terms of collecting ALL the data at one time, differentiating between the types of data, then chewing up the totals.
The tools for copying information from one type of record to another is the stats family... stats , eventstats , and streamstats . Use stats if there is a single key and the different kinds of records won't stomp on each other's data. Use eventstats if you need to generate and use group totals without destroying the underlying records. Use streamstats when you need to relate the records based on both key and order, for example when you need the last record of type X before type Y.
As an alternate technique, you can also use appendpipe to split off a group of records and analyze them, then use eventstats to roll the information back from the subset onto the regular records. (For example, if you wanted to have all the detail records for the groupid that had the five highest dollar totals, you use something like this...
| appendpipe [
|stats sum(total) as sumtotal by groupid
|sort 5 - total
|table groupid sumtotal
]
| eventstats values(sumtotal) as sumtotal by groupid
| where isnotnull(sumtotal)
... View more
