otel_delta

For gauges and non-monotonic sums, where a decrease is real rather than a counter restart. Use otel_increase for a monotonic counter (bzrk extension).

The argument is a dynamic of metric shape — the field set produced by the OTel-to-bzrk mapping (timestamp, value, start_time, aggregation_temporality, metric_hash, …) — of which $raw over a metric table is the usual source. Every field the aggregate needs, the series key included, is read from that one argument.

Takes no window argument. The group is the window.

Unlike the other otel_* aggregates this one reads gauges, which carry no aggregation_temporality and no start_time at all. Delta-temporality rows are already increments, so there the result is their signed sum rather than a span of pre-differenced values.

Series are detected via metric_hash and each series' own span is used, so interleaved series in one group do not read each other's first and last observations. The per-series changes are then summed.

No reset correction is deliberate, and it is the one shape where this aggregate can mislead: a monotonic counter that restarts inside the group loses its pre-restart rise. When that is detected — a monotonic sum whose start_time changed within the group — the query warns rather than returning a plausible number.

Returns null when delta-temporality rows are mixed with others, and null for an empty group.

otel_delta is itself an aggregate: use it directly as a summarize output — never nested inside another aggregate such as avg(...) or sum(...) (that is a WRONG FUNCTION CONTEXT error).

Syntax

otel_delta($raw)

Parameters

Returns: real

Examples

Example 1

// net change in a gauge over the query's range
OtelMetrics
| where metric_type == "gauge"
| where metric_name == "bzrk.query.cache.bytes_resident"
| summarize change = otel_delta($raw)

Example 2

// per-bin change of a non-monotonic cumulative sum, which may go negative
OtelMetrics
| where metric_type == "sum"
| summarize change = otel_delta($raw) by metric_name, bin(timestamp, 5m)