I am trying to get the delta of several key-value pairs over a period of an hour. The initial ingestion of data is from a few hours ago yet the earliest time slot for this timechart is empty and the second one has the full value (not the delta) causing my visualizations to be unreadable. I see what its doing - its basically trying to get the previous value for the earliest time slot for the time I've specified, seeing it empty and giving me the delta of the full value but I need it to recognize the previous value, instead of it being blank.
Here is a template for my query:
sourcetype=abc SCTP host="abc.com"
| timechart span=5m max(field1) as field1 max(field2) as field2
| delta field1 as field1d
| delta field2 as field2d
So my output in stats is :
FIRST ROW TIMESLOT: BLANK
SECOND ROW TIMESLOT: field1=2000 field2=5000
THIRD ROW TIMESLOT: field1=0 field2=3