Streamstats delta between values on grouped data incorrect

[peiffer]

I have data that is extracted from log events by multiple neighbor pairs. I would like to extract deltas on an integer field tableversion, but only among the same neighbor pair Streamstats was suggested for deltas with a ‘by’ clause. In my example below, the first line delta is empty as expected, and the 2nd line delta is correct. All deltas in later lines are incorrect. How do I make streamstats only look at the previous entry?

index=network_internal source="bgp.log" "BGP Queue" 
| eval neighborpair=host + ":" + neighbor
| sort neighborpair,timestamp
| streamstats window=2 global=f current=f first(tableversion) as tableversion_prev by neighborpair
| eval delta=tableversion-tableversion_prev
| table timestamp neighborpair neighborstate nsrstate tableversion delta inq outq prefixes

[martin_mueller · Accepted solution]

Either set current=t or window=1.

[peiffer]

Setting window=1 didn't work for me, but current=t did.

Thanks much