https://community.splunk.com/t5/Splunk-Search/How-to-find-deltas-for-multiple-fields-generically/m-p/42441#M9920 <P>Currently, the query ... | timechart span=1hr count by term limit=10 </P> <P>gives me </P> <P>_time apple orange banana</P> <P>3:00pm 123 138 100</P> <P>4:00pm 132 102 129 </P> <P>Is there a way to find the deltas of each term without naming each individual field in the query? The reason is because the field names (terms) may change (there are several hundred possible terms).</P> <P>I only know how to do ... | delta apple p=1 as apple_d </P> <P>but unfortunately, the apple term might be something else. So I am hoping for soemthing like ... | delta all_fields_except_time* p=1 as field_name_d </P> <P>Ultimately I want a table like _time apple_d orange_ d banana_d</P> Mon, 28 Sep 2020 12:50:54 GMT benobviate 2020-09-28T12:50:54Z https://community.splunk.com/t5/Splunk-Search/How-to-find-deltas-for-multiple-fields-generically/m-p/42441#M9920 <P>Currently, the query ... | timechart span=1hr count by term limit=10 </P> <P>gives me </P> <P>_time apple orange banana</P> <P>3:00pm 123 138 100</P> <P>4:00pm 132 102 129 </P> <P>Is there a way to find the deltas of each term without naming each individual field in the query? The reason is because the field names (terms) may change (there are several hundred possible terms).</P> <P>I only know how to do ... | delta apple p=1 as apple_d </P> <P>but unfortunately, the apple term might be something else. So I am hoping for soemthing like ... | delta all_fields_except_time* p=1 as field_name_d </P> <P>Ultimately I want a table like _time apple_d orange_ d banana_d</P> Mon, 28 Sep 2020 12:50:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-deltas-for-multiple-fields-generically/m-p/42441#M9920 benobviate 2020-09-28T12:50:54Z https://community.splunk.com/t5/Splunk-Search/How-to-find-deltas-for-multiple-fields-generically/m-p/42442#M9921 <P>This will give the absolute delta, with no indication of which value is bigger:</P> <PRE><CODE>... | streamstats range(*) window=2 </CODE></PRE> <P>The delta command does indeed not like wildcards.</P> Thu, 22 Nov 2012 10:44:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-deltas-for-multiple-fields-generically/m-p/42442#M9921 martin_mueller 2012-11-22T10:44:39Z https://community.splunk.com/t5/Splunk-Search/How-to-find-deltas-for-multiple-fields-generically/m-p/42443#M9922 <P>finally a use for untable. !<BR /><BR /> (not really - it you don't do timechart 1st, you wont be in this predicament )</P> <PRE><CODE>... | untable _time fruit count | streamstats current=false window=1 global=false first(count) as p_count by fruit | eval delta=p_count-count | xyseries _time fruit delta </CODE></PRE> <P>realistically, you would do the streamstats, manually calculate the delta, then do timechart on the delta field</P> Thu, 22 Nov 2012 17:53:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-deltas-for-multiple-fields-generically/m-p/42443#M9922 jonuwz 2012-11-22T17:53:09Z