How to edit my search to find the difference of a field from a previous poll, find the per second value, and display it on a timechart over 1 hour?

[mbond81]

I've scoured the Docs and Answers and haven't had any luck modifying their solutions to fit mine including streamstats and range. So here goes...

I'm using Splunk ver 6.2.0.
There is a script that runs every 5 min and returns several "fields". One such field increments errors, which I want to plot the DELTA of the previous poll as "errors per second" over the span of 1hr or more.

So I need it to take the difference of the previous poll, derive the per second value, then display it plotted over 1hr. Eventually, I would like to alert on those whose Delta crosses a threshold.

I've changed the search a million times, but this search string plotted both Errors AND the Difference. The difference value is so low that the Errors overpower it. I'm only interested in plotting the Difference, not the Errors, per se.

source=mysource  location=place1 car_Id=72 md_Id=61 | search "ErrCount" | timechart span=5m median(ErrCount) as Errors | delta Errors as difference

[mbond81]

I may have gotten this to work using...

|sort + _time| delta ErrCount as difference | timechart span=5m per_second(difference) by xyz useother=f usenull=f

I'll follow up later if this has answered my own question.