Given events Group MultiValue A 7,2,9 B 8,1 I'm using makemv to pivot the results to below, but I also want a new Index/Counter field which counts (or shows the index value) and resets when it sees a new group. The accum command doesn't support a "by [field list]" so curious how to do this? Group Value **Index/Counter** A 7 1 A 2 2 A 9 3 B 8 1 B 1 2 ... View more

I have a simple "| stats dc()" command to get a cumulative sum of distinct users; however, I don't want to have to run this query from the beginning of time every day it runs for performance reasons. These couple routes came to mind, but don't seem best... Summary indexes can write out the distinct users per day, but seems like couldn't compute distinct over the whole set of days. Write the distinct values to lookup and only adding the new values each day -- a kinda hacky incremental approach. Any ideas on the optimal solution? ... View more