I was able to finally get this working using the following query: search | bucket _time span=5m | stats sum(eval(Msgs)) as 5MinCount by host _time | delta 5MinCount | sort _time | stats latest by host | rename latest(delta(5MinCount)) as delta | stats sum(eval(delta/300)) as Transactions_per_sec by host This query above takes 2 samples of a cumulative total and finds the difference between them and then calculates the rate while ignoring the 1st set of delta data which is invalid since it has nothing to compare against. Hopefully this helps someone else in the same situation. For the record I still think that converting a cumulative total into a transaction rate should have been its own function in Splunk. Thanks, -Adrian ... View more