There is metric which accumulative counter of some event. Timechart of this metrics look like monotonic function. I cant change metrics therefor i need to calculate derivative function - increase/decrease of counter per period of time. Example query:
index=some_index host="*" | timechart span=15s max("some_metric") by host | addtotals fieldname=cur | appendcols [search index=some_index host="*" | eval _time=_time+15 | timechart span=15s max("some_metric") by host | addtotals fieldname=prev ] | eval diff=cur-prev | timechart span=1m max(diff) as "Aggregation"
index=some_index host="*" | timechart span=15s max("some_metric") by host | addtotals fieldname=cur - calculates total of all hosts
appendcols [search index=some_index host="*" | eval _time=_time+15 | timechart span=15s max("some_metric") by host | addtotals fieldname=prev ]- calculates total of all hosts with timeshift
Now I want to calculate subtraction. All goes fine with total, but how to calculate subtraction to each host?
