This sounds so easy but I can't seem to figure it out. Or maybe it's just ridiculous and there is a better way.
So I have
index=iis | timechart count by cs_uri_stem
And that's great, but what if I want to smooth out the timechart with an average? Or maybe just plot the deltas? Doing avg(count(_raw)) doesn't cut the mustard. Basically I want to try and stomp down the occasional spikes (which yes need attention in some circumstances) and just get an idea if hitcount is trending up. Any ideas?
There is also a
delta command if that is really what you want.
Here are some similar questions that might help you craft your search: