My current project polls a device every 15 minutes to pull a counter which is then charted. Thanks to members here, I now have this working as desired. Here is an example search: index=index | where key="key_01" | timechart span=15m values(value) by mac_address The key "key_01" is a counter that increases over time. If there is no more activity, the key stays at its current value. So over time, we are counting totals. This produces a lovely line chart or bar chart. I would now like to be able to instead display the delta between the values, so instead of showing the accumulated total, we only see "new" counters since the last value - ie the delta. I've been reading posts and playing with the delta command but so far not been able to get it to work.  Here is what I thought I would need: index=index | where key="key_01" | delta key_01 as delta_01 | timechart span=15m values(value) by mac_address I would like to ask if anyone can help with getting the syntax right. As always, any help very much appreciated! NM   ... View more

I have a problem where not all values are showing up in a chart - and the values that do show up are rather flatlined. For example, here is the data I gathered for this chart:   However, none of the earlier values show up in the chart. I have remade the index and the data is good coming in from the CSV files.   Can anyone help me identify what's wrong?   Many thanks. ... View more