How write a search to place averages from different time ranges on the same column chart?

[Bliide]

I am trying to place values with different time ranges on the same column chart. I have 3 values that I would like to place on the same chart for comparison. I would like the last value, the 24 hour average and the 7 day average of that value on the same chart. I cannot find how to configure the search to create the values. Is this something that I need to use an eval for?

[stephanefotso]

Hello! My proposition is not optimal, but it can help you as a start point. Let suppose you are working with the _internal index and you want the last sourcetype, the 24 hour average and the 7 day average of that value on the same chart. Here you go!

index=_internal sourcetype=*|stats first(sourcetype) count as countvalue|join [search index=_internal sourcetype=*|bucket  _time span=1d|stats count as total24h by _time | eventstats first(sourcetype) count as countfirst by _time|eval avg24h=countfirst/total24h|table avg24h]|join[search index=_internal sourcetype=*|bucket  _time span=7d|stats count as total7day by _time | eventstats first(sourcetype) count as countfirst by _time|eval avg7day=countfirst/total7day|table avg7day]|table countvalue avg24h avg7day

dmaslin_splunk's link can help you uptimise that query,

[dmaislin_splunk]

http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-joi...