Streamstats question

[jhayIV]

index=### sourcetype=####|table Server Server AppName AppProductName _time ServerRole ServerSerialNumber ServerSite | timechart span=1d dc(ServerName) as "count" by AppProductName|

Is there a good way to write a formula to see the deltas for each Product name

[somesoni2]

Try this

index=### sourcetype=####|table Server Server AppName AppProductName _time ServerRole ServerSerialNumber ServerSite | timechart span=1d dc(ServerName) as "count" by AppProductName
| streamstats current=f window=1 values(*) as prev_*
| foreach prev_* [eval delta_<<MATCHSTR>>='<<MATCHSTR>>'-'<<FIELD>>']