Delta based on multiple inboxes

[manderson7]

We've gotten a search to work that shows the delta between the number of messages in an inbox for a period of time:

<basesearch>
| bin _time span=5m
| stats max(Items) AS Max by _time
| delta Max as Delta
| fields _time Delta
| where Delta>=10

But I want to do this based on multiple inboxes, and delta is merging the inboxes together, so the values of each inbox are interfering with each other.

<basesearch multiple mailboxes>
| bin _time span=5m
| stats max(Items) AS Max  by _time User
| delta Max as Delta
| fields _time Delta User

returns:

_time	User	Max	Delta
09:15	user1	103
09:15	user2	251	148
09:15	user3	17	-234

and I want the users to be treated as individual accounts, not merged with each other. 

I assume I need to use streamstats for this, but so far I've been unable to work out how.

[richgalloway · Accepted solution]

Try this query

<basesearch multiple mailboxes>
| bin _time span=5m
| stats max(Items) AS Max  by _time User
| streamstats window=2 range(Max) as Delta by User
| fields _time Delta User

[manderson7]

That does the trick. Thanks so much.