<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Count based on a rolling average in All Apps and Add-ons</title>
    <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/Count-based-on-a-rolling-average/m-p/543186#M65098</link>
    <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168"&gt;@ITWhisperer&lt;/a&gt;&amp;nbsp;i am getting an error&amp;nbsp;&lt;SPAN&gt;Error in 'streamstats' command: time_window can only be used on input that is sorted in time order (both ascending and descending order are ok).&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;tried few options nothing worked, can you pls cross check..&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Wed, 10 Mar 2021 11:09:49 GMT</pubDate>
    <dc:creator>akpadhi</dc:creator>
    <dc:date>2021-03-10T11:09:49Z</dc:date>
    <item>
      <title>Count based on a rolling average</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/Count-based-on-a-rolling-average/m-p/543026#M65081</link>
      <description>&lt;P&gt;I have following query which provides me details of a db userid whenever the count crosses X value, however I want to modify this to a dynamic search based on a rolling average of that value for last 10 days. Can you pls help?&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;index=abc sourcetype=DBConnectionUsage&amp;nbsp; | spath cdb | spath pdb | spath application_user | search cdb=* pdb=* application_user = "*" cluster="E3"| bin span=30m _time| stats sum(connection_count) as connection_count by application_user, pdb | where connection_count &amp;gt;100&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;I want to modify the where condition to where connection_count &amp;gt; 'avg (conn count for last 10 days)'.&lt;/P&gt;</description>
      <pubDate>Wed, 10 Mar 2021 06:11:03 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/Count-based-on-a-rolling-average/m-p/543026#M65081</guid>
      <dc:creator>akpadhi</dc:creator>
      <dc:date>2021-03-10T06:11:03Z</dc:date>
    </item>
    <item>
      <title>Re: Count based on a rolling average</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/Count-based-on-a-rolling-average/m-p/543170#M65096</link>
      <description>&lt;P&gt;I presume you want time to be part of your stats and that the ten day average is for application_user and pdb.&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;index=abc sourcetype=DBConnectionUsage  
| spath cdb 
| spath pdb 
| spath application_user 
| search cdb=* pdb=* application_user = "*" cluster="E3"
| bin span=30m _time
| stats sum(connection_count) as connection_count by _time, application_user, pdb 
| streamstats time_window=10d avg(connection_count) as tendayavg by application_user, pdb
| where connection_count &amp;gt; tendayavg&lt;/LI-CODE&gt;</description>
      <pubDate>Wed, 10 Mar 2021 09:13:20 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/Count-based-on-a-rolling-average/m-p/543170#M65096</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2021-03-10T09:13:20Z</dc:date>
    </item>
    <item>
      <title>Re: Count based on a rolling average</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/Count-based-on-a-rolling-average/m-p/543186#M65098</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168"&gt;@ITWhisperer&lt;/a&gt;&amp;nbsp;i am getting an error&amp;nbsp;&lt;SPAN&gt;Error in 'streamstats' command: time_window can only be used on input that is sorted in time order (both ascending and descending order are ok).&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;tried few options nothing worked, can you pls cross check..&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Wed, 10 Mar 2021 11:09:49 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/Count-based-on-a-rolling-average/m-p/543186#M65098</guid>
      <dc:creator>akpadhi</dc:creator>
      <dc:date>2021-03-10T11:09:49Z</dc:date>
    </item>
    <item>
      <title>Re: Count based on a rolling average</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/Count-based-on-a-rolling-average/m-p/543188#M65099</link>
      <description>&lt;LI-CODE lang="markup"&gt;| stats ... by _time ...&lt;/LI-CODE&gt;&lt;P&gt;should be sorting by _time for you&lt;/P&gt;</description>
      <pubDate>Wed, 10 Mar 2021 11:18:27 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/Count-based-on-a-rolling-average/m-p/543188#M65099</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2021-03-10T11:18:27Z</dc:date>
    </item>
  </channel>
</rss>

