Cumulative Sum String field

[dro (Alejandro)]

I've tried searching on the forum, but haven't really found something similar.

Is there a method to show a cumulative sum of a field of type string using Lens or TVSB? For example a field of data with string types YES and NO , I would like to show a cumulative some of the field over time.

Currently the only way I can think of doing this is creating a run time field which converts the string into int so as to enable the functionality; I.E. YES = 1 and NO = 2 etc.

Realistically I can also convert the data to integers pre-ingestion using a lookup table style implementation, but I was really trying to avoid doing so and wondering if there is away to just do it based directly on the field itself.

[stephenb (Stephen Brown)]

Hi @dro

Did you try Lens with custom formula

To be clear it needs to be a keyword type not text

Lens Formula, this should work

cumulative_sum(count(kql = 'your_field : "YES"' ))

Formula Help is right there

[dro (Alejandro)]

I just realized the foolish mistake I was making after reading your post.

You are able to count the string field using the TSVB, but the interval range was set to auto so the count was per interval. By setting the interval range manually, you are able to show the count of the field over the entire span.

It's essentially showing a cumulative sum which is what I was looking for, but I gave myself tunnel vision by trying to do it directly with the cumulative sum calculation.

I will definitely be trying it your way however, because I like using the lens feature more.

[stephenb (Stephen Brown)]

Yup Typically more than one way .. depends if you just want a number or graph, if just a total number then yes over entire range will do it!

[stephenb (Stephen Brown)]

You can just do a metric in Lens as well and you don't need the cumaltive_sum part