Hi all I'd like to plot the difference between two values on a timechart Example data: _time a b t 10 1 t+1s 11 1.5 t+2s 12 2   Expected resulting data time a b c t 10 1 9 t+1s 11 1.5 9.5 t+2s 12 2 10   I'm using the query       index=indx sourcetype=src (Instrument="a" OR Instrument="b") | eval c = a - b | timechart values(a) values(b) values(c) span=1s       Any ideas where I'm going wrong? ... View more

I am querying a change in a value each week over last 4 weeks. Ineed to know the value from the week before the search window to work out the change correctly. index=ind sourcetype=src (type=instrument) earliest=-5w@w+1d latest=@w+1d | bucket _time span=7d | stats max(reading) as WeekMax by _time | streamstats current=f last(WeekMax) as LastWeekMax | eval WeekDelta = WeekMax - LastWeekMax | eval WeekDelta = if(WeekDelta < 0, 0.000000, WeekDelta) | table _time, WeekMax, WeekDelta I don't want to show the time for the week before the query (-5th week). Any tips on how to change this query to only show results for last 4 weeks but still calculating the change correctly?   Thanks ... View more