index=### sourcetype=####|table Server Server AppName AppProductName _time ServerRole ServerSerialNumber ServerSite | timechart span=1d dc(ServerName) as "count" by AppProductName|
Is there a good way to write a formula to see the deltas for each Product name
Try this
index=### sourcetype=####|table Server Server AppName AppProductName _time ServerRole ServerSerialNumber ServerSite | timechart span=1d dc(ServerName) as "count" by AppProductName
| streamstats current=f window=1 values(*) as prev_*
| foreach prev_* [eval delta_<<MATCHSTR>>='<<MATCHSTR>>'-'<<FIELD>>']