We are trying to show the bytes/s, averaged over 15 mins. I'm getting far lower results if I use per_second than a live timechart with a span of 1s, so:
index="datafeed" | where isnotnull(bytes) | timechart span=15m per_second(bytes)
Gives an average of 10mb/s
index="datafeed" | where isnotnull(bytes) | timechart span=1s sum(bytes)
Shows the data constantly hovering around the 100mb/s mark, so the 15 min average must be up at that level. Am I missing something obvious?
Thanks for any pointers!