Perform SUM and DIFF on multiple fields

[Atif]

Hi,

I'am sending some events each minute to Splunk :

TIME	ID	IN	OUT
08:00	A	1	0
08:00	B	0	0
08:01	A	2	1
08:01	B	2	2
08:01	C	4	0
08:02	A	3	3
08:02	B	3	2
08:03	A	6	4
08:03	B	3	3
08:04	A	6	4
08:04	B	3	3
08:04	C	4	2
08:05	A	6	4
08:05	B	3	3
08:05	C	4	2

What i'am trying to get as a result is :

TIME	SUMIN - PREVIOUS_SUMIN	SUMOUT - PREVIOUS_SUMOUT
08:00	=1+0 = 1	=0+0 = 0
08:01	=2+2+4 - (1+0) = 7	=1+2+0 - (0+0) = 3
08:02	=3+3 - (2+2+4) = -2	=3+2 - (1+2+0) = 2
08:03	=6+3 - (3+3) = 3	=4+3 - (3+2) = 2
08:04	=6+3+4 - (6+3) = 4	=4+3+2 - (4+3) = 2
08:05	=6+3+4 - (6+3+4) = 0	=4+3+2 - (4+3+2) = 0

After that i need to plot the two columns using a timechart by TIME

Any hints are welcome.

Thank you guys

[ITWhisperer]

| bin span=1m time
| stats sum(in) as in sum(out) as out by time
| streamstats window=1 current=f values(in) as previous_in values(out) as previous_out
| eval in_change=in-previous_in
| eval out_change=out-previous_out
| table time in_change out_change

[Atif]

Thank you @ITWhisperer  for your feedback.

I have tried your hint but i'am not getting the first line as expected :

[ITWhisperer · Accepted solution]

| bin span=1m time
| stats sum(in) as in sum(out) as out by time
| streamstats window=1 current=f values(in) as previous_in values(out) as previous_out
| fillnull value=0 previous_in previous_out
| eval in_change=in-previous_in
| eval out_change=out-previous_out
| table time in_change out_change