My query is returning the total number of bytes received by various IP addresses at different points in epoch time. I'm using a combination of sort, streamstats, and delta to show how many ADDITIONAL bytes have been received since the last record, for a given IP address. So the data for a given IP address would be:
The problem is that for each IP address's group of records, the delta for the first record shows up as zero since there is no previous record to 'delta' against. So when I run avg() and stdev() on the deltas (which is the end goal), there's always an unnecessary zero in the mix that skews the statistics. I tried assigning all zero-value deltas to 'null', but not only does that remove some valid 'zero' entries (like row number 4 above), the statistics are still generated based on the number of rows received, whether null or not, again skewing the results.
Is there a way for me to remove the first record for each IP address?