Archive

display running average with autoregress?

Path Finder

I am attempting to calculate a running average with autoregress for a count of errors across a group of servers. I'm using the following query to get the data in 5-minute slices

index="monitoring" ServerErrors  | timechart span=5m sum(ServerErrors)

How would I get a running average of the last four hours of the values generated here? Do I want to use something like

| autogregress p1-48

My experience here is very limited, so I'm certain there is much I don't know about what's going on here.

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

I'd go this route:

index="monitoring" ServerErrors 
       | timechart span=5m sum(ServerErrors) as Error5MinSum 
       | streamstats avg(Error5MinSum) window=48

http://www.splunk.com/base/Documentation/latest/SearchReference/Streamstats

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

I'd go this route:

index="monitoring" ServerErrors 
       | timechart span=5m sum(ServerErrors) as Error5MinSum 
       | streamstats avg(Error5MinSum) window=48

http://www.splunk.com/base/Documentation/latest/SearchReference/Streamstats

View solution in original post

0 Karma

Path Finder

Thanks. This provided the kind of information I wanted.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!