How to handle streamstats / delta assigning a 'zero' to the first row?

[AlexBryant]

My query is returning the total number of bytes received by various IP addresses at different points in epoch time. I'm using a combination of sort, streamstats, and delta to show how many ADDITIONAL bytes have been received since the last record, for a given IP address. So the data for a given IP address would be:

epoch_time; IP_address; delta_bytes_received
1000; 192.168.100.1; 0
1005; 192.168.100.1; 600
1008; 192.168.100.1; 70
1018; 192.168.100.1; 0
1021; 192.168.100.1; 223

The problem is that for each IP address's group of records, the delta for the first record shows up as zero since there is no previous record to 'delta' against. So when I run avg() and stdev() on the deltas (which is the end goal), there's always an unnecessary zero in the mix that skews the statistics. I tried assigning all zero-value deltas to 'null', but not only does that remove some valid 'zero' entries (like row number 4 above), the statistics are still generated based on the number of rows received, whether null or not, again skewing the results.

Is there a way for me to remove the first record for each IP address?

[jplumsdaine22 · Accepted solution]

Do something like | streamstats count as remove_me by ip | where NOT remove_me=1 before doing you calculations - that will remove the first instance of each ip

[AlexBryant]

Simple and works perfectly - thanks!