# Calculate a delta between two time slices
**URL:** https://discuss.elastic.co/t/calculate-a-delta-between-two-time-slices/307411
**Category:** Kibana
**Created:** [June 16, 2022, 1:14pm UTC](https://discuss.elastic.co/t/calculate-a-delta-between-two-time-slices/307411 "2022-06-16T13:14:22Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@Kohlman](https://discuss.elastic.co/u/Kohlman)
#### Post date: [June 16, 2022, 1:14pm UTC](https://discuss.elastic.co/t/calculate-a-delta-between-two-time-slices/307411/1 "2022-06-16T13:14:22Z")
Is there a visualization that can calculate a delta between to two most recent records or any two time slices for that matter. Specifically we have metricbeat data from SQL server. Many of the metrics we extract are cumulative. So we'd like to create something where I can show the deltas between two values.
---
### Author:  [@Marco\_Liberati](https://discuss.elastic.co/u/Marco_Liberati)
#### Post date: [June 16, 2022, 1:32pm UTC](https://discuss.elastic.co/t/calculate-a-delta-between-two-time-slices/307411/2 "2022-06-16T13:32:01Z")
Hi @Kohlman,
it depends a bit on what you are looking for.
You might use the `differences` operation for example to compute the delta between two consequent buckets, or be more explicit with two distinct offsets with a formula:
```auto
my_metric(my_field) - my_metric(my_field, shift='1w')
```
---
### Author:  [@Kohlman](https://discuss.elastic.co/u/Kohlman)
#### Post date: [June 16, 2022, 2:06pm UTC](https://discuss.elastic.co/t/calculate-a-delta-between-two-time-slices/307411/3 "2022-06-16T14:06:29Z")
Hi @Marco_Liberati ,
Thanks for the quick response. I've spent a few minutes trying to find out where I would do such a thing . . . but to no avail.
I've created something maybe similar in a TSVB visualization where I defined two averages and then created a third with Bucket Script where I defined a function that did a simple calculation of the first/ the second. See attached screenshot. I suspect what you are suggesting must be here, but not sure where I find information about the options for the function my\_metric. And where all this goes.
Can you point me to where I might find out more about where exactly you put such a function?
Thanks in advance for your time.
---
### Author:  [@Marco\_Liberati](https://discuss.elastic.co/u/Marco_Liberati)
#### Post date: [June 16, 2022, 2:23pm UTC](https://discuss.elastic.co/t/calculate-a-delta-between-two-time-slices/307411/4 "2022-06-16T14:23:39Z")
That is TSVB, while Formula is a feature available in the Lens editor.
You can find some complete examples of formula in this blog post here: [10 common Kibana visualization questions answered with formulas and time travel | Elastic Blog](https://www.elastic.co/blog/kibana-10-common-questions-formulas-time-series-maps#performance-comparison-week)
---
### Author:  [@Kohlman](https://discuss.elastic.co/u/Kohlman)
#### Post date: [June 17, 2022, 5:47pm UTC](https://discuss.elastic.co/t/calculate-a-delta-between-two-time-slices/307411/5 "2022-06-17T17:47:46Z")
@Marco_Liberati So this will actually help me with something else I need to create. But I don't think I can use this for my initial need. I realize I left something out of my initial description. The metric we pull out of SQL server and ingest to elastic is a value that constantly increase. For example:
- at T0, the cpu seconds used in say 500
- at T1, the cpu seconds used in say 550
From this I can calculate that the actual cpu seconds used between T0 and T1 is 50. We only import this metric once every 5 minutes. Hence why I'd like to be showing the deltas between the records, if possible.
Thanks in advance.
---
### Author:  [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)
#### Post date: [June 20, 2022, 9:47am UTC](https://discuss.elastic.co/t/calculate-a-delta-between-two-time-slices/307411/6 "2022-06-20T09:47:55Z")
If you can use date histogram aggregation to guarantee each bucket contains one document, [derivatige aggreagation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-derivative-aggregation.html) (or [serial differencing aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-serialdiff-aggregation.html)) could be an option to be considered.
---
### Author:  [@Kohlman](https://discuss.elastic.co/u/Kohlman)
#### Post date: [June 22, 2022, 4:59pm UTC](https://discuss.elastic.co/t/calculate-a-delta-between-two-time-slices/307411/7 "2022-06-22T16:59:49Z")
In the process of trying to figure this out I also discovered differences(last\_value(sql.metrics.numeric.waits)) which also gives me what I want.
@Tomo_M I could not figure out how to plug those into a lens to create a line graph. How do I plug these into a lens? I'd still like to use these for other things.
---
### Author:  [@Kohlman](https://discuss.elastic.co/u/Kohlman)
#### Post date: [June 22, 2022, 5:41pm UTC](https://discuss.elastic.co/t/calculate-a-delta-between-two-time-slices/307411/8 "2022-06-22T17:41:12Z")
The one downside to the differences is that you can only break it down by one field. Do the other functions support breaking it down by more then 1 field?
---
### Author:  [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)
#### Post date: [June 22, 2022, 11:22pm UTC](https://discuss.elastic.co/t/calculate-a-delta-between-two-time-slices/307411/9 "2022-06-22T23:22:06Z")
Use Quick function of `Differences`:
What do you mean by "break down by more then 1 field" ?
---
### Author:  [@Kohlman](https://discuss.elastic.co/u/Kohlman)
#### Post date: [June 24, 2022, 3:50pm UTC](https://discuss.elastic.co/t/calculate-a-delta-between-two-time-slices/307411/10 "2022-06-24T15:50:26Z")
Hi @Tomo_M,
My previous post wasn't clear. I figured out how to use the Differences function. I did not figure out how to use [derivatige aggreagation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-derivative-aggregation.html) (or [serial differencing aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-serialdiff-aggregation.html)
Regarding the Differences break down by one field see the screen shots below.
There is no way to add a second field.
I tried the "Add layer" but that seems to allow you to create another line on the graph also only "grouped" by one field.
In my case I created a new run time filed where I concatenated the two fields I wanted to see my data by.
Thanks,
Kohlman
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 22, 2022, 3:50pm UTC](https://discuss.elastic.co/t/calculate-a-delta-between-two-time-slices/307411/11 "2022-07-22T15:50:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.