Window operators :: Kloudfuse Docs

Window operators

accum

Computes the cumulative running sum of a numeric field across time-ordered rows. Each output row contains the sum of the current row’s value plus all previous rows' values, optionally grouped by one or more fields. Use accum to build running totals — for example, cumulative request counts or cumulative error counts over a time window.

Syntax

| accum(<field>) [as <alias>] [by <field1>, <field2>, ...]

Parameters

Parameter	Required	Description
`<field>`	Required	The numeric field to accumulate.
`as <alias>`	Optional	Output column name for the running sum. Defaults to `_accum`.
`by <field1>, …`	Optional	Groups accumulation by one or more fields, restarting the running sum independently for each group.

Example

Count nginx requests per 1-minute bucket, then compute a running cumulative total across all buckets.

source="nginx"
| timeslice 1m
| count by (_timeslice, source)
| accum(_count) as cumulative_requests

_timeslice	source	_count	cumulative_requests
2026-06-27 18:53:00 UTC	nginx	61,441	61,441
2026-06-27 18:54:00 UTC	nginx	650,712	712,153
2026-06-27 18:55:00 UTC	nginx	474,040	1,186,193

rollingstd

Computes the rolling standard deviation of a numeric field over a sliding window of rows. Each output row contains the standard deviation of the current and preceding N−1 rows. Use rollingstd to detect volatility in time-series data — a sudden increase in rolling standard deviation can indicate instability or an anomalous traffic pattern.

Syntax

| rollingstd(<field>) [, <window>] [as <alias>]

Parameters

Parameter	Required	Description
`<field>`	Required	The numeric field over which to compute the rolling standard deviation.
`<window>`	Optional	Number of rows in the sliding window. Defaults to `10`.
`as <alias>`	Optional	Output column name for the rolling standard deviation values. Defaults to `_rollingstd`.

Example

Count nginx requests per 1-minute bucket, then compute the rolling standard deviation over a 3-row window to identify volatile time periods.

source="nginx"
| timeslice 1m
| count by (_timeslice, source)
| rollingstd(_count, 3) as rolling_stddev

_timeslice	source	_count	rolling_stddev
2026-06-27 18:53:00 UTC	nginx	61,441	0
2026-06-27 18:54:00 UTC	nginx	650,712	294,636
2026-06-27 18:55:00 UTC	nginx	474,040	244,984

smooth

Applies a moving average (rolling mean) to a numeric field over a sliding window of rows. Each output row contains the average of the current and preceding N−1 rows. Use smooth to reduce noise in time-series data — for example, to flatten short-lived traffic spikes before charting.

Syntax

| smooth(<field>) [, <window>] [as <alias>]

Parameters

Parameter	Required	Description
`<field>`	Required	The numeric field to smooth.
`<window>`	Optional	Number of rows in the sliding window. Defaults to `10`.
`as <alias>`	Optional	Output column name for the smoothed values. Defaults to `_smooth`.

Example

Count nginx requests per 1-minute bucket, then apply a 3-row moving average to smooth short-lived spikes.

source="nginx"
| timeslice 1m
| count by (_timeslice, source)
| smooth(_count, 3) as smoothed_requests

_timeslice	source	_count	smoothed_requests
2026-06-27 18:53:00 UTC	nginx	61,441	61,441
2026-06-27 18:54:00 UTC	nginx	650,712	356,077
2026-06-27 18:55:00 UTC	nginx	474,040	395,397

total

Adds the grand total of a numeric field across all rows (or per group) as an additional column. Unlike aggregation operators that reduce the row count, total preserves every row and appends the sum as a new field. Use total to compute what percentage of the overall traffic each time bucket or group represents.

Syntax

| total(<field>) [as <alias>] [by <field1>, <field2>, ...]

Parameters

Parameter	Required	Description
`<field>`	Required	The numeric field to sum across all rows.
`as <alias>`	Optional	Output column name for the total. Defaults to `_total`.
`by <field1>, …`	Optional	Groups the total computation by one or more fields, so each group produces its own independent total.

Example

Count nginx requests per 1-minute bucket, append the grand total, and compute each bucket’s share of traffic.

source="nginx"
| timeslice 1m
| count by (_timeslice, source)
| total(_count) as total_requests
| (_count / total_requests) * 100 as pct_of_total

_timeslice	_count	total_requests	pct_of_total
2026-06-27 18:53:00 UTC	61,441	1,868,307	3.29
2026-06-27 18:54:00 UTC	650,712	1,868,307	34.83
2026-06-27 18:55:00 UTC	474,040	1,868,307	25.37