I have 12 months of financial data where I am trying to extract the payees whose transaction totals for a sliding 5 day window exceeds 10,000.00.
The data is structured
datetime payee amount
01/03/2011 10:28:58 GARY SMITH 875.01
etc...
I've tried
| bucket _time span=1d
| streamstats sum(amount) as TotalAmount, count(remitter) as PayeeChecks window=5 by _time,payee
| chart sum(TotalAmount) sum(PayeeChecks) by payee
No joy...
Looking for guidance on how to approach this.
Try this:
... | bucket _time span=1d |stats sum(amount) AS DailyAmount, count(remitter) AS PayeeChecks BY _time,payee | streamtstats window=5 sum(DailyAmount) AS AmountLast5Days, sum(PayeeChecks) AS PayeeChecksLast5Days BY payee