I have multiple events like :
field 1; otherTimestamp; field2;field3;field4 test;1371481920.000000,value2,valeu3... test,1371481980.000000,value4,value5... otherttest,1371481920.000000,value...
I want to compute a delta on the othertimestamp field, but the delta should be 0, if the field1 changed... I also want to see all other fields for each event.
I tried to use delta, but I couldn't make delta begin at 0, on field1 changed...
I've tried to put a | transaction field1 | in front of the delta, but then all the lines are in a single event, and I'd like distinct events...
Can I do it with streamstats somehow ? what is the best way