In the following search, for each search result a new field is appended with a count of the results based on the host value. The count is cumulative and includes the current result.

| from <dataset> | streamstats count()

For example, if your data looks like this:

The output would look like this:

The following search uses the host field to reset the count. For each search result a new field is appended with a count of the results based on the host value. The count is cumulative and includes the current result.

| from <dataset> | streamstats count() BY host

For example, if your data looks like this:

The output would look like this:

This example performs an aggregation on the bytes field and displays the total number of bytes by host. The total number of bytes are reset when either action="REBOOT" or when the host changes. The reset options must be specified before the aggregation.

...| streamstats reset after action="REBOOT" onchange sum(bytes) AS total_bytes BY host

For each event, compute the average of the bytes field over the last 5 events, including the current event. The window option must be specified before the aggregation.

... | streamstats window=5 avg(bytes)

You can use the streamstats command with other commands to create a set events with hourly timestamps. For example, you can use the repeat function, with the eval and streamstats commands to create a set of 5 events with incremental timestamps:

| FROM repeat({}, 5) 
| eval _time = now()
| streamstats count()
| eval _time=_time-(count*3600)

The results look something like this:

For more examples like this, see the "Examples" section in the repeat dataset function topic.