trendline wma2 is showing different results between Statistics Table and Single Value

[WEI_LI_YU]

Hi splunkers,

I'm using the same query for different panels - timechart, statistics table and single value.
Noticed that the single value is showing the difference between the previous and the current date.
On statistics table the wma2 is working as designed, trendline also.

However, I would like my timechart to show a trendline with the difference between the dates. By having negative difference it should go below Y=0.

Here is the query I'm using:

index=reporting sourcetype=reporting_json alertId=1234
| timechart span=1w count(alertId) as Test
| trendline wma2("x") as trend
| sort - _time

Example of statistics table results:
Date Count WMA
June 7 1593 1976
june 6 2742 2650.3333

On Single value it is showing: 1593 and smaller number on its side, -1,149

[WEI_LI_YU · Accepted solution]

Found the solution by using delta - http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Delta

It was changed to the below:

index=reporting sourcetype=reporting_json alertId=1234
| timechart span=1w count(alertId) as Test
| delta Test p=1 as Difference

[aaraneta_splunk]

@WEI_LI_YU - Glad you were able to find the solution to your question. Please don't forget to click "Accept" to resolve your question so others can find it. Thanks!