I am attempting to calculate a running average with autoregress for a count of errors across a group of servers. I'm using the following query to get the data in 5-minute slices
index="monitoring" ServerErrors | timechart span=5m sum(ServerErrors)
How would I get a running average of the last four hours of the values generated here? Do I want to use something like
| autogregress p1-48
My experience here is very limited, so I'm certain there is much I don't know about what's going on here.
I'd go this route:
| timechart span=5m sum(ServerErrors) as Error5MinSum
| streamstats avg(Error5MinSum) window=48
View solution in original post
Thanks. This provided the kind of information I wanted.