Window operators

FuseQL window operators enable you to perform calculations across a specific set of rows, or a window, while retaining the individual rows in the dataset. Unlike traditional aggregate functions that summarize data for the entire group, window operators allow detailed calculations for specific partitions or subsets of data.

Window functions apply ONLY to numerical data.

accum

Computes the cumulative running sum of a numeric field across time-ordered rows. Each output row contains the sum of the current row’s value plus all previous rows' values, optionally grouped by one or more fields. Use accum to build running totals — for example, cumulative request counts or cumulative error counts over a time window.

Syntax

| accum(<field>) [as <alias>] [by <field1>, <field2>, ...]
none

Parameters

Parameter Required Description

<field>

Required

The numeric field to accumulate.

as <alias>

Optional

Output column name for the running sum. Defaults to _accum.

by <field1>, …​

Optional

Groups accumulation by one or more fields, restarting the running sum independently for each group.

Example

Count nginx requests per 1-minute bucket, then compute a running cumulative total across all buckets.

source="nginx"
| timeslice 1m
| count by (_timeslice, source)
| accum(_count) as cumulative_requests
Expected output
_timeslice source _count cumulative_requests

2026-06-27 18:53:00 UTC

nginx

61,441

61,441

2026-06-27 18:54:00 UTC

nginx

650,712

712,153

2026-06-27 18:55:00 UTC

nginx

474,040

1,186,193

accum operates on time-ordered rows produced by a preceding timeslice stage. It works in the Advanced Search time-series panel and in the tabular API when preceded by an aggregation. When using by, each unique combination of group values maintains its own independent running sum.

rollingstd

Computes the rolling standard deviation of a numeric field over a sliding window of rows. Each output row contains the standard deviation of the current and preceding N−1 rows. Use rollingstd to detect volatility in time-series data — a sudden increase in rolling standard deviation can indicate instability or an anomalous traffic pattern.

Syntax

| rollingstd(<field>) [, <window>] [as <alias>]
none

Parameters

Parameter Required Description

<field>

Required

The numeric field over which to compute the rolling standard deviation.

<window>

Optional

Number of rows in the sliding window. Defaults to 10.

as <alias>

Optional

Output column name for the rolling standard deviation values. Defaults to _rollingstd.

Example

Count nginx requests per 1-minute bucket, then compute the rolling standard deviation over a 3-row window to identify volatile time periods.

source="nginx"
| timeslice 1m
| count by (_timeslice, source)
| rollingstd(_count, 3) as rolling_stddev
Expected output
_timeslice source _count rolling_stddev

2026-06-27 18:53:00 UTC

nginx

61,441

0

2026-06-27 18:54:00 UTC

nginx

650,712

294,636

2026-06-27 18:55:00 UTC

nginx

474,040

244,984

rollingstd operates on time-ordered rows produced by a preceding timeslice stage. It is designed for the Advanced Search time-series panel. The first row in each group returns 0 (only one data point — standard deviation is undefined). Pair rollingstd with smooth to compare the moving average against the rolling variability band.

smooth

Applies a moving average (rolling mean) to a numeric field over a sliding window of rows. Each output row contains the average of the current and preceding N−1 rows. Use smooth to reduce noise in time-series data — for example, to flatten short-lived traffic spikes before charting.

Syntax

| smooth(<field>) [, <window>] [as <alias>]
none

Parameters

Parameter Required Description

<field>

Required

The numeric field to smooth.

<window>

Optional

Number of rows in the sliding window. Defaults to 10.

as <alias>

Optional

Output column name for the smoothed values. Defaults to _smooth.

Example

Count nginx requests per 1-minute bucket, then apply a 3-row moving average to smooth short-lived spikes.

source="nginx"
| timeslice 1m
| count by (_timeslice, source)
| smooth(_count, 3) as smoothed_requests
Expected output
_timeslice source _count smoothed_requests

2026-06-27 18:53:00 UTC

nginx

61,441

61,441

2026-06-27 18:54:00 UTC

nginx

650,712

356,077

2026-06-27 18:55:00 UTC

nginx

474,040

395,397

smooth operates on time-ordered rows produced by a preceding timeslice stage. It is designed for the Advanced Search time-series panel. The first row of each group is returned unchanged (the window is not yet fully populated). Larger window sizes produce stronger smoothing but also more lag before the average reflects a true trend change.

total

Adds the grand total of a numeric field across all rows (or per group) as an additional column. Unlike aggregation operators that reduce the row count, total preserves every row and appends the sum as a new field. Use total to compute what percentage of the overall traffic each time bucket or group represents.

Syntax

| total(<field>) [as <alias>] [by <field1>, <field2>, ...]
none

Parameters

Parameter Required Description

<field>

Required

The numeric field to sum across all rows.

as <alias>

Optional

Output column name for the total. Defaults to _total.

by <field1>, …​

Optional

Groups the total computation by one or more fields, so each group produces its own independent total.

Example

Count nginx requests per 1-minute bucket, append the grand total, and compute each bucket’s share of traffic.

source="nginx"
| timeslice 1m
| count by (_timeslice, source)
| total(_count) as total_requests
| (_count / total_requests) * 100 as pct_of_total
Expected output
_timeslice _count total_requests pct_of_total

2026-06-27 18:53:00 UTC

61,441

1,868,307

3.29

2026-06-27 18:54:00 UTC

650,712

1,868,307

34.83

2026-06-27 18:55:00 UTC

474,040

1,868,307

25.37

total operates on time-ordered rows produced by a preceding timeslice stage. It is designed for the Advanced Search time-series panel. Unlike accum (which produces a running sum), total adds the same fixed grand total to every row, making it ideal for percentage-of-total calculations.