sourcetype="MATIZ" host=A OR host=B or host=C
| base search
| timechart span=1d eval(round(avg(response_time),2)) by host
with a search preset for 'last 30 days'
Our system comprises of three hosts. Using the above query gives me average response_time by each host. But I don't want that.
I want the visualization of simple moving average of response time of the entire system as a whole, not by each host.
A Trendline would help.
Need assistance here.
Thank you.
hello there,
try trendline
or streamstats
check out the following answers:
https://answers.splunk.com/answers/189759/how-to-calculate-moving-average-and-graph-it-as-an.html
https://answers.splunk.com/answers/554522/what-is-the-best-way-to-get-the-running-average-an.html
https://answers.splunk.com/answers/542213/moving-average-query.html
you can try and remove you by host
clause to get the "system as a whole" or use a function that present your idea of "system as a whole"
hope it helps