Finding the delta in Splunk

Every few months I need the difference between an event and the one before it, and every few months I look it up again. Writing it down here so that stops happening.

The search

index=main sourcetype=metrics
| streamstats current=f last(value) as prev
| eval delta = value - prev
| table _time value prev delta

current=f is the whole trick — it makes last() look at the previous row instead of this one.

Why current=f

Sort first. streamstats trusts the order it is given, and search results are not sorted by time by default.

If you skip the sort, prev will happily point at whatever row the search pipeline handed over — which is usually not the chronologically previous event. Add an explicit sort 0 _time before streamstats when you cannot guarantee the order.

Gaps and spikes

If the series has gaps, wrap the eval in a null check before you graph it — otherwise the first event in every bucket reads as a giant spike:

| eval delta = if(isnull(prev), 0, value - prev)

That one guard has saved me more confused dashboard screenshots than anything else in this note.