https://community.splunk.com/t5/Splunk-Search/Using-delta-with-events-that-need-to-be-grouped-by-another/m-p/79026#M19994 <P>I have events that contain a counter of a number of packets sent. Each event applies only to a single port.</P> <P>How do I graph the rate of packets sent per port? </P> <P>I've tried using delta, but I can't work out how to do that per port.</P> Tue, 01 Oct 2013 21:54:07 GMT tomdee 2013-10-01T21:54:07Z https://community.splunk.com/t5/Splunk-Search/Using-delta-with-events-that-need-to-be-grouped-by-another/m-p/79026#M19994 <P>I have events that contain a counter of a number of packets sent. Each event applies only to a single port.</P> <P>How do I graph the rate of packets sent per port? </P> <P>I've tried using delta, but I can't work out how to do that per port.</P> Tue, 01 Oct 2013 21:54:07 GMT https://community.splunk.com/t5/Splunk-Search/Using-delta-with-events-that-need-to-be-grouped-by-another/m-p/79026#M19994 tomdee 2013-10-01T21:54:07Z https://community.splunk.com/t5/Splunk-Search/Using-delta-with-events-that-need-to-be-grouped-by-another/m-p/79027#M19995 <P>delta is only really a comparison between 2 events.</P> <P>Would something like this work?</P> <PRE><CODE>| timechart packets by port </CODE></PRE> Wed, 02 Oct 2013 01:13:13 GMT https://community.splunk.com/t5/Splunk-Search/Using-delta-with-events-that-need-to-be-grouped-by-another/m-p/79027#M19995 justinfranks 2013-10-02T01:13:13Z