My issue is I have a table like that :
|field 1||field 2|
I want to create an third column that create the result of :
first line = field1 - field2=field3
second line = first line field3 + second line field1 - second line field2=new field3
third line = second line field3 + third line field1 - third line field2=new field3
|field 1||field 2||field 3|
Can you help me ?
the result is wrong :
You can see that the field_3 is not correct because it must be LAST field_3+field IN - field OUT
the field_3 here just calculate field IN - field OUT.
example of line 5 : -2 (last field_3)+4-0=2 and not 4
Can we do that ?
I just add your commands after my chart command :
| chart count(user) over _time by type
| autoregress field_3
| fillnull value=0 field_3_p1
| eval field_3=field_3_p1+IN-OUT