Streamstats question

jhayIV — Wed, 28 Jun 2017 20:01:45 GMT

index=### sourcetype=####|table Server Server AppName AppProductName _time ServerRole ServerSerialNumber ServerSite | timechart span=1d dc(ServerName) as "count" by AppProductName|

Is there a good way to write a formula to see the deltas for each Product name

Re: Streamstats question

somesoni2 — Wed, 28 Jun 2017 20:06:52 GMT

Try this

index=### sourcetype=####|table Server Server AppName AppProductName _time ServerRole ServerSerialNumber ServerSite | timechart span=1d dc(ServerName) as "count" by AppProductName
| streamstats current=f window=1 values(*) as prev_*
| foreach prev_* [eval delta_<<MATCHSTR>>='<<MATCHSTR>>'-'<<FIELD>>']

topic Streamstats question in Splunk Search

Streamstats question

Re: Streamstats question