How to table/chart over a period of time

[clintla]

trying to calculate groupings of VMs capacity growth over time but a chart or table looks to be the best answer if you need to report on 100 VMs.

In a simplified data set per below
Date ,Name,Capacit Used
5/1/2019, VM1,100
5/1/2019, VM2,100
5/1/2019, VM4,450
6/1/2019, VM1,100
6/1/2019, VM2,140
6/1/2019, VM4,450
7/1/2019, VM1,105
7/1/2019, VM2,200
8/1/2019, VM1,110
8/1/2019, VM2,200
9/1/2019, VM1,110
9/1/2019, VM2,200
10/1/2019,VM1,110
10/1/2019,VM2,200
10/1/2019,VM3,100
11/1/2019,VM1,110
11/1/2019,VM2,200
11/1/2019,VM3,200

How can you search it so that if you search for 7/1/2019 through 11/1/2019 that the result would be tabled as

VM1 5GB
VM2 0GB
VM3 200GB

So this almost needs to be like a delta except that its clobbered by VMs that are not in the beginning or ending of the time range.

If a VM is created in the time range then its starting capacity should be 0

[clintla]

I've tried a lot of variations but I need to figure out how to take the beginning time of capacity_used and subtract the ending time of capacity_used

Stuff like stats.. just adds up some capacity.

I was doing earliest(capacity_used) minus latest(capacity_used) but that gets clobbered by VM's that were not present either at the beginning or end of the time range.. like VM3 in my example

[yannK]

if you have a period and want to measure the delta. try the streamstats.

    | bucket _time span=1d | stats max(capacity_used) AS daily_usage by _time Name| streamstats first(daily_usage) AS first_value last(daily_usage) As last_value by Name  window=2| eval delta=last_value - first_value

[clintla]

I like the idea but still is clobbered by if a VM is not in the start or end of a selected time frame.

I was using earliest & latest which works great if a VM is present at the start and end of a selected time frame.

If a VM is added in the middle of a selected time frame & its 500GB then its earliest is 500GB. (should be 0) which makes the growth calculation inaccurate.