Hello,
Having replaced the existing system with Splunk I have a question about how to replicate a particular type of graph. The logs are being parsed and I can do simple searches and dashboards but I don't have access to the server - all I can do is make searches and dashboards. What I want is a graph that has data points every five minutes and each point is the average of the previous 15 minute period.
So, the log contains a numeric value and on the graph the rightmost data point is the average of the last 15 minute period and the data point immediately to its left is the average of the 15 minutes ending 5 minutes ago and the data point immediately to its left is the average of the 15 minutes ending 10 minutes ago.
How can I do that?
Thanks!
Hi jerry_jeremiah,
take this run everywhere example, which counts the events and average of the field kbps
over five minutes, next the streamstats will aggregate the timechart results over 15 minutes (using the window=3 argument) and returns the average count and average kbps
over the last 15 minutes in a time related chart:
index=_internal earliest=-2h@h
| timechart span=5m count, avg(kbps) as avg_kbps
| streamstats window=3 avg(count) as avg_count, avg(avg_kbps) as avg_kbps
adapt this search and use the Visualization and the format to display the graph in a way that fits your needs.
hope this helps ...
cheers, MuS
Hi jerry_jeremiah,
take this run everywhere example, which counts the events and average of the field kbps
over five minutes, next the streamstats will aggregate the timechart results over 15 minutes (using the window=3 argument) and returns the average count and average kbps
over the last 15 minutes in a time related chart:
index=_internal earliest=-2h@h
| timechart span=5m count, avg(kbps) as avg_kbps
| streamstats window=3 avg(count) as avg_count, avg(avg_kbps) as avg_kbps
adapt this search and use the Visualization and the format to display the graph in a way that fits your needs.
hope this helps ...
cheers, MuS
That works great! In the end I aggregate the sum and count and then divide at the end with an eval because the average of three averages isn't a real average. Thanks so much for the help.