I've tried searching on the forum, but haven't really found something similar.
Is there a method to show a cumulative sum of a field of type
string using Lens or TVSB? For example a field of data with string types
NO , I would like to show a cumulative some of the field over time.
Currently the only way I can think of doing this is creating a run time field which converts the
int so as to enable the functionality; I.E.
YES = 1 and
NO = 2 etc.
Realistically I can also convert the data to integers pre-ingestion using a lookup table style implementation, but I was really trying to avoid doing so and wondering if there is away to just do it based directly on the field itself.
Did you try Lens with custom formula
To be clear it needs to be a
keyword type not
Lens Formula, this should work
cumulative_sum(count(kql = 'your_field : "YES"' ))
Formula Help is right there
I just realized the foolish mistake I was making after reading your post.
You are able to count the string field using the TSVB, but the
interval range was set to auto so the
count was per interval. By setting the interval range manually, you are able to show the count of the field over the entire span.
It's essentially showing a cumulative sum which is what I was looking for, but I gave myself tunnel vision by trying to do it directly with the
cumulative sum calculation.
I will definitely be trying it your way however, because I like using the lens feature more.
Yup Typically more than one way .. depends if you just want a number or graph, if just a total number then yes over entire range will do it!
You can just do a metric in Lens as well and you don't need the
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.