Splunk Search
Highlighted

Streamstats question

Engager

index=### sourcetype=####|table Server Server AppName AppProductName _time ServerRole ServerSerialNumber ServerSite | timechart span=1d dc(ServerName) as "count" by AppProductName|

Is there a good way to write a formula to see the deltas for each Product name

0 Karma
Highlighted

Re: Streamstats question

SplunkTrust
SplunkTrust

Try this

index=### sourcetype=####|table Server Server AppName AppProductName _time ServerRole ServerSerialNumber ServerSite | timechart span=1d dc(ServerName) as "count" by AppProductName
| streamstats current=f window=1 values(*) as prev_*
| foreach prev_* [eval delta_<<MATCHSTR>>='<<MATCHSTR>>'-'<<FIELD>>']
0 Karma