https://community.splunk.com/t5/Other-Usage/Error-in-streamstats-command-The-argument-diff-count-is-invalid/m-p/631768#M2 <P>I am running the following query:<BR /><BR />index="ABCi" sourcetype=DEF<BR />| timechart span=1h count<BR />| fields - _time<BR />| streamstats current=t diff(count) as count_diff<BR />| stats avg(count_diff)<BR /><BR /><BR />BUT, I am receiving the following error:<BR /><BR /><SPAN>Error in 'streamstats' command: The argument 'diff(count)' is invalid.</SPAN><BR /><BR />Can you please help?<BR /><BR />Thanks<BR /><BR /><BR /></P> Tue, 21 Feb 2023 23:16:46 GMT POR160893 2023-02-21T23:16:46Z https://community.splunk.com/t5/Other-Usage/Error-in-streamstats-command-The-argument-diff-count-is-invalid/m-p/631768#M2 <P>I am running the following query:<BR /><BR />index="ABCi" sourcetype=DEF<BR />| timechart span=1h count<BR />| fields - _time<BR />| streamstats current=t diff(count) as count_diff<BR />| stats avg(count_diff)<BR /><BR /><BR />BUT, I am receiving the following error:<BR /><BR /><SPAN>Error in 'streamstats' command: The argument 'diff(count)' is invalid.</SPAN><BR /><BR />Can you please help?<BR /><BR />Thanks<BR /><BR /><BR /></P> Tue, 21 Feb 2023 23:16:46 GMT https://community.splunk.com/t5/Other-Usage/Error-in-streamstats-command-The-argument-diff-count-is-invalid/m-p/631768#M2 POR160893 2023-02-21T23:16:46Z https://community.splunk.com/t5/Other-Usage/Error-in-streamstats-command-The-argument-diff-count-is-invalid/m-p/631770#M3 <P>diff() isn't a stats aggregation function - you could use range() instead, and perhaps a window size of 2</P><LI-CODE lang="markup">| streamstats current=t window=2 diff(count) as count_diff</LI-CODE><P>&nbsp;</P> Tue, 21 Feb 2023 23:49:04 GMT https://community.splunk.com/t5/Other-Usage/Error-in-streamstats-command-The-argument-diff-count-is-invalid/m-p/631770#M3 ITWhisperer 2023-02-21T23:49:04Z