Hi, I have have a list of events that contain a customer ID. I'm trying to detect when I have a sequence of events with incremental changes to the ID Example: - event A - ID0 - event B - ID1 - event C- ID2 - event D - ID3   I might have other events between these increments that could have unrelated IDs (i.e: event A ID0 - event H ID 22, event B ID1) I've tried using | streamstats current=f last(CustomerID) as prev_CustomerID | eval increment = CustomerID - prev_CustomerID but without any luck.   Do you guys know a way this could be achieved ?             ... View more