My input data is I have a total device count that is updated daily. I am trying to show a week by week growth so I only need to get one of the values each week and then take the difference between the weeks and show it as a column report. Easy so far.
here is what a single days input looks like, I have one of these per day:
When I run the following query: index=caabistats | bucket span=1w _time | stats values(total_found_devices), first(total_found_devices), last(total_found_devices), latest(total_found_devices) by _time
I can see the 7 daily values and using the first, last and latest functions it shows the values from the bucket. When looking at the Statistics tab everything looks good on the first page of results, but starting on the second page the first, last and latest start choosing random items in the bucket but not every bucket has the problem but the majority of them do. The first and latest values are always the same.
Now this only happens when I am in the fast or smart modes. If I change the mode to verbose then the values are always correct. Looking around I cannot see a way to make the verbose method the default in my advanced XML. Seems like the first, last functions are not correct unless I am in verbose mode.
I have also tied to change the query around like this with the exact same results
index=caabistats |timechart span="1w" last(total_found_devices) as dev_count
| delta dev_count as dev_diff
| timechart span="1w" values(dev_diff) as "Total Devices"