Splunk Search

Streamstats question

jhayIV
Engager

index=### sourcetype=####|table Server Server AppName AppProductName _time ServerRole ServerSerialNumber ServerSite | timechart span=1d dc(ServerName) as "count" by AppProductName|

Is there a good way to write a formula to see the deltas for each Product name

0 Karma

somesoni2
Revered Legend

Try this

index=### sourcetype=####|table Server Server AppName AppProductName _time ServerRole ServerSerialNumber ServerSite | timechart span=1d dc(ServerName) as "count" by AppProductName
| streamstats current=f window=1 values(*) as prev_*
| foreach prev_* [eval delta_<<MATCHSTR>>='<<MATCHSTR>>'-'<<FIELD>>']
0 Karma