Even though this thread is old, it's perhaps worth noting the ability to use TERM and PREFIX with tstats, which I believe was introduced in Splunk 8 at the end of 2019, which would not have been possible when this question was written. https://conf.splunk.com/files/2020/slides/PLA1089C.pdf   ... View more

Yeah, I didn't think about the fact that delta isn't a steaming command. It looks so much nicer all bundled up inside a foreach loop! 🙂 ... View more