Diff of two values over time for multiple events in one search

[burgean]

I have a search:

index=storage_summary sourcetype="isilon:quota"| eval Usage_GB=round('usage.logical'/1024/1024/1024,0) | delta Usage_GB as delta | eval change = Usage_GB - delta | timechart span=1week values(Usage_GB) values(change) by path where count in top400

At this point I get an output like this:

And the change value is this:

I need to do some diff on each of these columns (there are a lot) to see the change from one weekly value to the next.  For instance the path 3DDental changed from 227GB to 233GB.  The change value isn't right for each consecutive week for each path.  For instance, the 3DDental path, the change values should be 1,1,1,1,3 for each week interval.  3DMD didn't change so those values should be 0 for each week interval.

Is delta not the right command to use?

[burgean]

Woot!  That worked! I still needed to do the top400 thing so that all the paths are evaluated, but the numbers are correct!  Thank you so much!

index=storage_summary sourcetype="isilon:quota"| eval Usage_GB=round('usage.logical'/1024/1024/1024,0) | sort path _time | delta Usage_GB as delta | streamstats count as row by path
| where row > 1 | timechart span=1week values(Usage_GB) values(delta) by path where count in top400

[burgean]

This data collects the usage on a quota path on our NAS system.  The data is collected once a week, which is a snapshot of space usage for each path.  There are about 360 paths we collect this value on.  I would like to see the incremental change in usage for each path week over week.  Then I can chart or list which path had the highest space consumption over a given week to get an idea how fast the usage is growing, per path.  

[ITWhisperer · Accepted solution]

How about something like this:

index=storage_summary sourcetype="isilon:quota"
/* Get usage in GB */
| eval Usage_GB=round('usage.logical'/1024/1024/1024,0)
/* Sort by path then _time */
| sort path _time 
/* Get change in usage */
| delta Usage_GB as delta 
/* At this point, when you change paths, delta will be the difference between the first usage for a path and the last usage for the previous path. So, eliminate the first usage for each path */
| streamstats count as row by path
| where row > 1
| fields - row
/* Now chart the usage and delta by path over time */
| timechart span=1week values(Usage_GB) values(delta) by path

[ITWhisperer]

I am not sure whether you are using delta in the correct way. Delta will give you the change in the value of a field in two consecutive rows. In your search, you have used it after the initial search where the results will most likely be in time order so you will be comparing Usage_GB for two events which may not be related by path. Next, you are subtracting the difference from the current Usage_GB which in effect should give you the previous Usage_GB. Then you use timechart to group these results by week and path. I am not sure what this chart would even represent. What is it that you are actually trying to do?