We want to end up with this kind of table on a dashboard.
Average GB By Host and Time host last 24 hours last week last month web1 31.42 14.2 18.66 web2 33.59 32.4 32.14 web1 43.5 35.3 34.91
However we cant think of a way to do this without running subsearches and using the join command which seems very nasty.
In this example we'd run the search over the last month and get the big stat that way, and then run 2 other searches in join commands to get the other ones. Again, very very nasty. And although it might work, we're worried about the scaling limits when using join and we're pretty sure the number of events in this case will hit the limits, which rules this out anyway.
But is there any other way to actually get these in a table or chart?
If it's not in a table, we can think of a limited alternative using NxM SingleValue modules but that would be a little lame and we're hoping to really getting this data in single tables and graphable in single charts.
set the timerange to the latest month (i.e. earliest=-1month)
<your search for events> | eval label = if(now() - _time <= 24*3600, "last24;lastweek;lastmonth", if(now() - _time <= 7*24*3600, "lastweek;lastmonth", "lastmonth)) | makemv label delim=";" | chart avg(GB) by host label
Nice. I'd gone in that direction a little but was fishing for another way. 😃 It would be awesome if somehow you could use the relative time specifiers themselves somewhere. And this is nonsense, but something vaguely like "avg(GB) where _time in timerange(-30d@d, @d) avg(GB) where _time in timerange(-1d@d, @d) "
answering my own comment - you can actually use the relative time specifiers themselves in eval now. See 'relative_time' in http://www.splunk.com/base/Documentation/latest/SearchReference/CommonEvalFunctions