https://community.splunk.com/t5/Splunk-Search/display-running-average-with-autoregress/m-p/57313#M179937 <P>I am attempting to calculate a running average with autoregress for a count of errors across a group of servers. I'm using the following query to get the data in 5-minute slices</P> <PRE><CODE>index="monitoring" ServerErrors | timechart span=5m sum(ServerErrors) </CODE></PRE> <P>How would I get a running average of the last four hours of the values generated here? Do I want to use something like </P> <PRE><CODE>| autogregress p1-48 </CODE></PRE> <P>My experience here is very limited, so I'm certain there is much I don't know about what's going on here. </P> Fri, 11 Mar 2011 05:22:53 GMT dang 2011-03-11T05:22:53Z https://community.splunk.com/t5/Splunk-Search/display-running-average-with-autoregress/m-p/57313#M179937 <P>I am attempting to calculate a running average with autoregress for a count of errors across a group of servers. I'm using the following query to get the data in 5-minute slices</P> <PRE><CODE>index="monitoring" ServerErrors | timechart span=5m sum(ServerErrors) </CODE></PRE> <P>How would I get a running average of the last four hours of the values generated here? Do I want to use something like </P> <PRE><CODE>| autogregress p1-48 </CODE></PRE> <P>My experience here is very limited, so I'm certain there is much I don't know about what's going on here. </P> Fri, 11 Mar 2011 05:22:53 GMT https://community.splunk.com/t5/Splunk-Search/display-running-average-with-autoregress/m-p/57313#M179937 dang 2011-03-11T05:22:53Z https://community.splunk.com/t5/Splunk-Search/display-running-average-with-autoregress/m-p/57314#M179938 <P>I'd go this route:</P> <PRE><CODE>index="monitoring" ServerErrors | timechart span=5m sum(ServerErrors) as Error5MinSum | streamstats avg(Error5MinSum) window=48 </CODE></PRE> <P><A href="http://www.splunk.com/base/Documentation/latest/SearchReference/Streamstats" rel="nofollow">http://www.splunk.com/base/Documentation/latest/SearchReference/Streamstats</A></P> Fri, 11 Mar 2011 06:05:29 GMT https://community.splunk.com/t5/Splunk-Search/display-running-average-with-autoregress/m-p/57314#M179938 David 2011-03-11T06:05:29Z https://community.splunk.com/t5/Splunk-Search/display-running-average-with-autoregress/m-p/57315#M179939 <P>Thanks. This provided the kind of information I wanted.</P> Fri, 11 Mar 2011 07:49:32 GMT https://community.splunk.com/t5/Splunk-Search/display-running-average-with-autoregress/m-p/57315#M179939 dang 2011-03-11T07:49:32Z