posted Aug 24 @ 09:12 by christer · splunk
Comparing a value to the previous event is the thing I look up every single time. streamstats current=f is the whole trick — sort first, because it trusts the order it is given.
| streamstats current=f last(value) as prev | eval delta = value - prev