I have a log file that produces two fields - kernel_packets and kernel_drops. These values are updated every 5 minutes, and accumulate until the app is restarted. That is, each value is larger than the previous. I need to calculate the percent loss over that 5 minute interval. I want to be able to chart these values over time. To do this (kernel_drops(at T=0) - kernel_drops (T-5) / kernel_packets (T=0) - kernel_packets(T-5)) *100 I can use the delta function to get on of the values for on or the other but not both index=data host="server_name" source="/usr/local/var/log/suricata/stats.json" | stats count by _time,stats.capture.kernel_packets |delta stats.capture.kernel_packets p=1 How can I get the delta function to work on both parameters? ... View more