Archive
Highlighted

display running average with autoregress?

Path Finder

I am attempting to calculate a running average with autoregress for a count of errors across a group of servers. I'm using the following query to get the data in 5-minute slices

index="monitoring" ServerErrors  | timechart span=5m sum(ServerErrors)

How would I get a running average of the last four hours of the values generated here? Do I want to use something like

| autogregress p1-48

My experience here is very limited, so I'm certain there is much I don't know about what's going on here.

Tags (1)
0 Karma
Highlighted

Re: display running average with autoregress?

Motivator

I'd go this route:

index="monitoring" ServerErrors 
       | timechart span=5m sum(ServerErrors) as Error5MinSum 
       | streamstats avg(Error5MinSum) window=48

http://www.splunk.com/base/Documentation/latest/SearchReference/Streamstats

View solution in original post

0 Karma
Highlighted

Re: display running average with autoregress?

Path Finder

Thanks. This provided the kind of information I wanted.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.