How to find the average count of events for a timechart?

[robertlabrie]

This sounds so easy but I can't seem to figure it out. Or maybe it's just ridiculous and there is a better way.

So I have

index=iis | timechart count by cs_uri_stem

And that's great, but what if I want to smooth out the timechart with an average? Or maybe just plot the deltas? Doing avg(count(_raw)) doesn't cut the mustard. Basically I want to try and stomp down the occasional spikes (which yes need attention in some circumstances) and just get an idea if hitcount is trending up. Any ideas?

[Sukisen1981]

| timechart span=1h count as events | eventstats sum(events) as z| eventstats count(events) as y |eval average=round(z/y,2)|fields

Ultimately the average = sum/count

[Sukisen1981]

| timechart span=1h count as events | eventstats sum(events) as z| eventstats count(events) as y |eval average=round(z/y,2)|fields

[aljohnson_splun]

Percentiles, variance, population variance, sum of squares, and standard deviation all come to mind.

There is also a delta command if that is really what you want.

Here are some similar questions that might help you craft your search:

http://answers.splunk.com/answers/141302/plot-rate-of-change.html

http://answers.splunk.com/answers/102969/display-standard-deviation-stdev-percentage.html

[aljohnson_splun]

Have you looked at X11 ? Or trendline ? Trendline has exponential moving averages as well as weighted moving averages.