Give this a try
your base search | bucket span=1m _time | stats count by _time | accum count
Give this a try
your base search | bucket span=1m _time | stats count by _time | accum count
Thanks Its works now..
Without knowing what your search is, it's hard to say exactly. That said, look into the "streamstats" command, which should allow you to generate a running total across your results, which you can then chart.
Yes.You can say that.
Are you asking for cumulative sum of transactions per minute?