deriv

Unlike rate(), does not detect counter resets and can return negative values. Takes a value column and a timestamp column. An optional third argument specifies the rate duration (default: 1s). (bzrk extension)

deriv is itself an aggregate: use it directly as a summarize/make-series output — never nested inside another aggregate such as avg(...) or sum(...). To combine across series, aggregate the per-series result in a second summarize.

Syntax

deriv(value, timestamp)

Parameters

Returns: real

Syntax

deriv(value, timestamp, per_duration)

Parameters

Returns: real

Examples

Example 1

datatable(ts:datetime, gauge_value:real)[
  datetime(2024-01-01), 10.0,
  datetime(2024-01-02), 20.0,
  datetime(2024-01-03), 30.0
]
| summarize deriv(gauge_value, ts)

Example 2

datatable(ts:datetime, gauge_value:real)[
  datetime(2024-01-01), 10.0,
  datetime(2024-01-02), 20.0,
  datetime(2024-01-03), 30.0
]
| summarize deriv(gauge_value, ts) by bin(ts, 1d)