I have a search: index=storage_summary sourcetype="isilon:quota"| eval Usage_GB=round('usage.logical'/1024/1024/1024,0) | delta Usage_GB as delta | eval change = Usage_GB - delta | timechart span=1week values(Usage_GB) values(change) by path where count in top400 At this point I get an output like this: And the change value is this: I need to do some diff on each of these columns (there are a lot) to see the change from one weekly value to the next. For instance the path 3DDental changed from 227GB to 233GB. The change value isn't right for each consecutive week for each path. For instance, the 3DDental path, the change values should be 1,1,1,1,3 for each week interval. 3DMD didn't change so those values should be 0 for each week interval. Is delta not the right command to use?
... View more