I am running the following search:
index=fi | stats last(BP) as start,first(BP) as last by Name | eval diff=last-start | sort diff | tail 10
This will essentially use the BP field (a floating point number), and calculate the oldest BP value minus the latest BP value, then sort the results, and present the 10 highest positive numbers in a stats table.
This is a real time search, looking back at the last 12 hours.
Each minute at 20 second intervals, there is new data ingested with new BP values.
The problem I have, is in the results returned the first set provide the correct values in 'diff'. But after the second data set comes in and the real time search refreshes, all results are wrong, and 'diff' resets to '0' for nearly all results.
Interestingly I have had this running now for almost 2 days, and it only became a problem this morning, with this strange behaviour.
Can anyone explain what is going on, please?
Happy to provide more info if needed.
