Plotting 2 week moving average for response data

kunadkat — Mon, 28 Sep 2020 11:49:23 GMT

I am plotting reponse time data using the following search

sourcetype="jboss" TOTAL SEARCH TIME CAREWEB AND NOT PMR | eval rp=EASYDOC_JBOSS_TIME/1000 | timechart span="1h" avg(rp)

Is is possible to plot 2 week moving average as a base line with this chart

Re: Plotting 2 week moving average for response data

lguinn2 — Tue, 15 May 2012 21:43:43 GMT

sourcetype="jboss" TOTAL SEARCH TIME CAREWEB AND NOT PMR earliest=-24h@h latest=@h | 
eval rp=EASYDOC_JBOSS_TIME/1000 | 
bucket _time span=1h |
stats avg(rp) as avgRP by _time |
eval series = "average RP" |
append [ search 
sourcetype="jboss" TOTAL SEARCH TIME CAREWEB AND NOT PMR earliest=-29d latest=@h | 
eval rp=EASYDOC_JBOSS_TIME/1000 | 
timechart count span=1h | 
streamstats window=168 avg(rp) as avgRP |
eval series = "moving avg RP" |
fields _time, avgRP, series ] |
where _time > relative_time(now(),"-24h@h") |
timechart span=1h max(avgRP) as "Average RP" by series

There are some dates in this search that you probably need to adjust:

window=168 because 2 weeks = 7*24 hours = 168 hours, so thats what streamstats needs to compute the moving average. You may not need to change this.
earliest=-24h@h in the first search. I just wanted to make the search time range explicit, so that the whole search makes sense. You could use the dropdown time range picker in the UI instead. But if you choose a different time range, you will definitely need to adjust the remaining time ranges in this list
earliest=-16d in the inner search. This should be set to at least 2 weeks + the time period in the first search. You may want to play with this a bit; i added an extra day to avoid having to worry about partial days.
where _time > relative_time(now(),"-24h@h") - this statement eliminates the extra events that are created by the inner search while computing the rolling average. The -24h@h must be the same time range as in the first search.

By default, the inner search will run over all time, so you really do need to constrain the time range of the inner search.

Let me know if this works!

Re: Plotting 2 week moving average for response data

kunadkat — Wed, 16 May 2012 02:09:53 GMT

I am getting an error for the following line. It is complaining that "Error in 'eval' command: The operator at 'fields _time avgRP, series' is invalid"

eval series = "moving avg RP"
fields _time, avgRP, series

Thanks,

Re: Plotting 2 week moving average for response data

lguinn2 — Wed, 16 May 2012 18:38:50 GMT

Oops, missing a pipe! I edited my answer above.

topic Plotting 2 week moving average for response data in Splunk Search

Plotting 2 week moving average for response data

Re: Plotting 2 week moving average for response data

Re: Plotting 2 week moving average for response data

Re: Plotting 2 week moving average for response data