We have data which will display total tarnsactions and success transactions count based on our time range.But we got one requirement that when some incident happen that time the count we are getting very less compared to other days.So our target is whenever we got that type less transactions we need to average for last 3 days total transactions and display that number instead of less transaction count.Please help how to solve this.
| streamstats window=3 sum(Total_tranasactions) as rolling3total count as days by Date
| eval average3days=rolling3total / days
| eval Total_tranasactions=if(Total_tranasactions < 20, average3days, Total_tranasactions)
