The accumulate() function can be used to calculate a running aggregation. It works with any aggregator that outputs a single event, such as sum() or avg():

head() 
| accumulate(avg(value))

The query is used to calculate the running average of fields. The query calculates moving averages that change as new values arrive.

For a description of the query, see Calculate Running Average of Field Values.

To compute a cumulative aggregation for a specific group (for example, by user), the accumulate() function can be used inside the groupBy() function:

head() 
| groupBy(key, function = accumulate(sum(value)))

The query is used to compute a cumulative aggregation for a specific group.

For a description of the query, see Compute Cumulative Aggregation For Specific Group .

A common use case is to accumulate values across time intervals, such as days. This can be achieved by applying the accumulate() function after a bucket() or timeChart() function:

timeChart(span=1000ms, function=sum(value)) 
| accumulate(sum(_sum, as=_accumulated_sum))

The query is used to accumulate values across time intervals/buckets. The query is, for example, useful for tracking cumulative metrics or identifying trends in the data.

For a description of the query, see Compute Cumulative Aggregation Across Buckets.

Accumulations can also be partitioned based on a condition, such as a change in value. This is achieved by combining three functions:

The following shows an example that counts events within partitions defined by changes in the key field:

head() 
| neighbor(key, prefix=prev) 
| partition(accumulate(count()), condition=test(key != prev.key))

The query is used to count events within partitions based on a specific condition. The query is useful for analyzing sequences of events, especially when you want to identify and count consecutive occurrences of a particular attribute in order to identify and analyze patterns or sequences within your data.

This approach can be extended to use any condition for partitioning, expressed as a{query}.

For a description of the query, see Count Events Within Partitions Based on Condition.

head() 
| neighbor(value, prefix=prev) 
| change := value - prev.value 
| change > 5

The query is used to detect changes in values and alert on large increase. The query will identify events where the value has increased by more than 5 compared to the previous event. The query is useful for real-time monitoring and alerting systems where you need to quickly identify significant changes in sequential data. It allows for immediate detection of anomalies or important shifts in your data, enabling prompt responses to potential issues or opportunities.

For a description of the query, see Detect Changes And Compute Differences Between Events - Example 1.

head() 
| neighbor(start, prefix=prev) 
| duration := start - prev.start 
| accumulate(sum(duration, as=accumulated_duration))

Given the start time of each step in a process, it calculates duration of each step along with accumulated duration of the full process.

The query is used to calculate the time difference between consecutive events. The query is useful for analyzing temporal data, to provide insights into process efficiency, system performance over time etc.

For a description of the query, see Detect Changes And Compute Differences Between Events - Example 2.

For more information on the individual sequence function and more examples, see accumulate(), slidingWindow(), slidingTimeWindow(), neighbor(), or partition().

head() 
| groupBy(
  key,
  function = partition(
      condition=test(status=="success"),
      split="after",
      [
          { status="failure" 
| count(as=failures) }, 
          range(@timestamp, as=timespan), 
          max(@timestamp), 
          selectLast(status)
      ]
  )
)
| failures >= 3 
| status = "success"

The query is used to detect instances where there are 3 or more failed attempts followed by a successful attempt. The query can be used to detect a brute force attack where an attacker tries multiple times before succeeding. Note that the effectiveness of this query depends on the nature of your data and the typical patterns in your system.

For a description of the query, see Detect Event A Happening X Times Before Event B.

head() 
| groupBy(
      key,
      function=slidingTimeWindow(
          [{status="failure" 
| count(as=failures)}, selectLast(status)],
          span=3s
      )
  ) 
| failures >= 3 
| status="success"

The query is used to detect event A happening X times before event B within a specific timespan. It looks for instances where there were 3 or more failed attempts followed by a successful attempt, all occurring within a 3-second window. Using a sliding time window of 3 seconds, provides a more precise time constraint compared to the usage of partition() in Detect Event A Happening X Times Before Event B. The query can be used to detect potential brute force attack patterns within a specific timeframe. Note that the effectiveness of this query depends on the nature of your data and the typical patterns in your system.

For a description of the query, see Detect Event A Happening X Times Before Event B Within a Specific Timespan.

head() 
| groupBy(
    key,
    function = partition(
        condition=test(status=="success"),
        split="after",
        [
            { status="failure" 
| count(as=failures) }, 
            range(@timestamp, as=timespan), 
            selectLast(status)
        ]
    )
  ) 
| failures >= 3 
| status = "success"

The query is used to detect all occurrences of potential brute force attack patterns within the specified timeframe. It looks for instances where there were 3 or more failed attempts (event A) followed by a successful attempt (event B), regardless of the time between failures.

For a description of the query, see Detect All Occurrences of Event A Before Event B.

head() 
| slidingTimeWindow(
    [{event = "A" 
| count(event, as=countAs)} , selectLast(event)], 
    span=1s
  ) 
| countAs > 0 
| event = "B"

The query is used to detect instances where event B occurs quickly (within 1 second) after event A. The query is useful for identifying sequences of events that happen in quick succession, which could indicate specific patterns of behavior or system interactions.

For a description of the query, see Detect Two Events Occurring in Quick Succession.

For more information on the individual sequence function and more examples, see accumulate(), slidingWindow(), slidingTimeWindow(), neighbor(), or partition().