What is the best way to generate a report to compare average time over last 30 days with today's average time?

[uhkc777]

I want to compare Avg time to process over last 30 days data and Avg time for today. If today's Avg is < 30 days Avg i need to generate a report. I can write it by using append command to calculate average over last 30 days but it's taking lot of time to load every time. Is there any other way to built this?.

I read about summary indexing but not sure how is it helpful in this situation.

Any suggestions on this is helpful for me.

Thanks,

[somesoni2]

Assuming you already got the query using append/appendcols to get and compare the average and only performance is the issue, I believe summary indexing/or datamodel will definitely help here. The query for last 30 days would be the one causing slower performance and if you can pre-calculate that (calculate running last 30 day average), it will be become faster.

[uhkc777]

Thank you. How can I use datamodel in this?

[somesoni2]

YOu can create data model for your base search (more info here)
and then accelerate it for appropriate Summary Range (30 day time period, see more info here ).

Then use the data model query to calculate 30 day (you can also use it for today's) average values. Will be much faster.

[sundareshr]

Try this

index=foo sourcetype=foo earliest=-3d@d | eval when=if(_time>relative_time(now(), "@d"), "Today", "Month") | stats avg(response_time) as avgtime by when

[uhkc777]

What is Today and Month in eval?. It's taking it as strings.

[sundareshr]

Those values/strings are set based on the _time value. If _time is greater/newer than start of the day (@d), then it is Today, else Month