How do I graph aggregated data points?

[jerry_jeremiah]

Hello,

Having replaced the existing system with Splunk I have a question about how to replicate a particular type of graph. The logs are being parsed and I can do simple searches and dashboards but I don't have access to the server - all I can do is make searches and dashboards. What I want is a graph that has data points every five minutes and each point is the average of the previous 15 minute period.

So, the log contains a numeric value and on the graph the rightmost data point is the average of the last 15 minute period and the data point immediately to its left is the average of the 15 minutes ending 5 minutes ago and the data point immediately to its left is the average of the 15 minutes ending 10 minutes ago.

How can I do that?

Thanks!

[MuS · Accepted solution]

Hi jerry_jeremiah,

take this run everywhere example, which counts the events and average of the field kbps over five minutes, next the streamstats will aggregate the timechart results over 15 minutes (using the window=3 argument) and returns the average count and average kbps over the last 15 minutes in a time related chart:

index=_internal earliest=-2h@h 
| timechart span=5m count, avg(kbps) as avg_kbps 
| streamstats window=3 avg(count) as avg_count, avg(avg_kbps) as avg_kbps

adapt this search and use the Visualization and the format to display the graph in a way that fits your needs.

hope this helps ...

cheers, MuS

[jerry_jeremiah]

That works great! In the end I aggregate the sum and count and then divide at the end with an eval because the average of three averages isn't a real average. Thanks so much for the help.