Find the difference in the values between rows and save them in a new column (inputColumn_diff).

This operator requires the lhub_ts column. It first orders rows by the lhub_ts column and then computes the difference between consecutive rows.

Operator Usage in Easy Mode

Click + on the parent node.
Enter the Find Difference operator in the search field and select the operator from the Results to open the operator form.
In the Select Baseline drop-down, enter or select the baseline to pull data from.
Optional fields
Start Time: Enter an offset time or a specific start time to pull the data from. Offset time
allows you to set time in seconds, minutes, hours, days, or weeks; Specific time allows you to
select the date and time.
End Time: Enter an offset time or a specific end time to pull the data from. Offset time allows
you to set time in seconds, minutes, hours, days, or weeks; Specific time allows you to select
the date and time.
Click Run to view the result.
Click Save to add the operator to the playbook.
Click Cancel to discard the operator form.

Usage Details

LQL Command

findDiff(table, column)

Input
table: Table to diff. This table must have an lhub_ts column.
column: Name of the column to find the difference.

Output
The input table with an additional column with the _diff suffix.

Input

LQL command

findDiff(table, "bytes_out")

Output

The output table is sorted by lhub_ts, and difference is calculated between consecutive rows.