topic Re: How do I graph aggregated data points? in Dashboards & Visualizations

How do I graph aggregated data points?

jerry_jeremiah — Tue, 03 Jun 2014 05:25:28 GMT

Hello,

Having replaced the existing system with Splunk I have a question about how to replicate a particular type of graph. The logs are being parsed and I can do simple searches and dashboards but I don't have access to the server - all I can do is make searches and dashboards. What I want is a graph that has data points every five minutes and each point is the average of the previous 15 minute period.

So, the log contains a numeric value and on the graph the rightmost data point is the average of the last 15 minute period and the data point immediately to its left is the average of the 15 minutes ending 5 minutes ago and the data point immediately to its left is the average of the 15 minutes ending 10 minutes ago.

How can I do that?

Thanks!

Re: How do I graph aggregated data points?

MuS — Tue, 03 Jun 2014 06:26:56 GMT

Hi jerry_jeremiah,

take this run everywhere example, which counts the events and average of the field kbps over five minutes, next the streamstats will aggregate the timechart results over 15 minutes (using the window=3 argument) and returns the average count and average kbps over the last 15 minutes in a time related chart:

index=_internal earliest=-2h@h 
| timechart span=5m count, avg(kbps) as avg_kbps 
| streamstats window=3 avg(count) as avg_count, avg(avg_kbps) as avg_kbps

adapt this search and use the Visualization and the format to display the graph in a way that fits your needs.

hope this helps ...

cheers, MuS

Re: How do I graph aggregated data points?

jerry_jeremiah — Wed, 04 Jun 2014 00:59:05 GMT

That works great! In the end I aggregate the sum and count and then divide at the end with an eval because the average of three averages isn't a real average. Thanks so much for the help.