.....|top limit=0 app_id app_name | fields + count, total_count, percent,app_name, app_id | accum count AS total_count
Is there any way to get a running total to put the total at the top of the page instead of the bottom?
I also tried using the stats sum(count), but all i get is one field instead of everything else that I have in my chart.
Pipe to | reverse
to reverse the events (or in this case, entries in the table).
I just want the total count to come to the top and the rest of the fields stay the same.
so your saying:
top limit=0 app_id app_name | fields + count, total_count, percent,app_name, app_id | accum count AS total_count | reverse total_count
because i cant seem to get this to work either