I am trying to place values with different time ranges on the same column chart. I have 3 values that I would like to place on the same chart for comparison. I would like the last value, the 24 hour average and the 7 day average of that value on the same chart. I cannot find how to configure the search to create the values. Is this something that I need to use an eval for?
Hello! My proposition is not optimal, but it can help you as a start point. Let suppose you are working with the _internal index and you want the last sourcetype, the 24 hour average and the 7 day average of that value on the same chart. Here you go!
index=_internal sourcetype=*|stats first(sourcetype) count as countvalue|join [search index=_internal sourcetype=*|bucket _time span=1d|stats count as total24h by _time | eventstats first(sourcetype) count as countfirst by _time|eval avg24h=countfirst/total24h|table avg24h]|join[search index=_internal sourcetype=*|bucket _time span=7d|stats count as total7day by _time | eventstats first(sourcetype) count as countfirst by _time|eval avg7day=countfirst/total7day|table avg7day]|table countvalue avg24h avg7day
dmaslin_splunk's link can help you uptimise that query,