Identify which power meter reading has stopped increasing for 5 days

[splunk_rookie]

Hi, I am trying to identify which power meter reading has stopped increasing for 5 days. 

As these power values are accumulated, I assumed that they are always in sequential order with respect to time. Therefore, I sorted the data by ASSET_NAME and _time to get the latest value. Then I took the difference between the latest value for every 5 days. So if the difference is 0, it means that there is no power increment.

Do you think that this logic flow is correct? Below is my code:

| bucket _time span=5d

| sort 0 ASSET_NAME _time

| stats latest(VALUE) as latestValue by ASSET_NAME _time

| delta latestValue as difference

| search difference = 0

Also, let's say the power values are not in sequential order due to some issue, how can I accurately identify the  power meter that has stopped increasing?

Please help. Thank you! 🙂

[ITWhisperer]

Rather than latest, how about using max()?

[splunk_rookie]

I get the same result as using latest ()

Anyway, I came up with another solution. First I sorted by ASSET_NAME and _time, then I used delta to find the power difference between each consecutive events. Next i used delta again to find the duration between the two events. Lastly I searched for power difference = 0 and duration > 432000 sec (5days).