findDiff

Find the difference in the values between rows and save them in a new column (inputColumn_diff).

This operator requires the lhub_ts column. It first orders rows by the lhub_ts column and then computes the difference between consecutive rows.

Operator Usage in Easy Mode

1. Click + on the parent node.
2. Enter the Find Difference operator in the search field and select the operator from the Results to open the operator form.
3. In the Select Baseline drop-down, enter or select the baseline to pull data from.
4. Optional fields
   Start Time: Enter an offset time or a specific start time to pull the data from. Offset time
   allows you to set time in seconds, minutes, hours, days, or weeks; Specific time allows you to
   select the date and time.
   End Time: Enter an offset time or a specific end time to pull the data from. Offset time allows
   you to set time in seconds, minutes, hours, days, or weeks; Specific time allows you to select
   the date and time.
5. Click Run to view the result.
6. Click Save to add the operator to the playbook.
7. Click Cancel to discard the operator form.

Usage Details

LQL Command

findDiff(table, column)

Input
table: Table to diff. This table must have an lhub_ts column.
column: Name of the column to find the difference.

Output
The input table with an additional column with the _diff suffix.

Example

Input

LQL command

findDiff(table, "bytes_out")

Output

The output table is sorted by lhub_ts, and difference is calculated between consecutive rows.