Find rate from total

[matthewcanty]

I want to take a totals field. And display the rate on a chart.

For example:

Total = 0, 1, 2, 3, 4, 5, 6, 7, 9, 10

Rate = 0, 1, 1, 1, 1, 1, 1, 1, 2, 1.

                              __
        _____________________/  \__   
   ____/

Take that as a rough guide anyway. I have looked through List(X) to see all my values which works, but I cannot figure out how you subtract the Last(X) value from the 'LastMinusOne(X)' value...

Thanks - and sorry for the crude graph 🙂

[ziegfried · Accepted solution]

I think the delta command is what you're looking for:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delta

  ... | delta total as rate | eval rate=coalesce(rate,0)

[matthewcanty]

Sorry I'm very new to these operations. How can I use this on a field value eg TotalNumbers=16 and chart it?