I have been using following siddhi query
to get the events count per minute; ts as timestamp (string) and ftp_requests as count (int).
from FTPInStream[command == 'USER']
select time:timestampInMilliseconds(time:dateAdd(str:replaceAll(ts,'T',' '), 5, 'hour',"yyyy-MM-dd HH:mm:ss"),'yyyy-MM-dd HH:mm') as milliseconds , uid, id_orig_h, id_orig_p, id_resp_h, id_resp_p
insert into intermediateStream;
from intermediateStream#window.externalTimeBatch( milliseconds ,1 min, milliseconds, 1 min)
select time:dateFormat(milliseconds, 'yyyy-MM-dd HH:mm' ) as ts , cast(count(milliseconds), 'int') as ftp_requests
group by milliseconds
insert into FTPOutStream;
If I want to add previous value of ftp_requests in each new value to get the accumulative number of requests with each new requests, what change would be required? Is there any function in siddhi to get the previous event value from stream that has already been published?