Plot Avg, Std Dev and Data on the same Chart

[proletariat99]

Hi,
I realize there are a number of ways to approach putting multiple values in a time chart, but I'm not sure how best to go about this in Splunk. In R or matplotlib, it's pretty easy -- you establish your figure, then add components to it and tweak those components as necessary. In Splunk, nearly everything is instantiated using eval, which is confusing and serial. What I'm trying to do is simple:

For a given data set, split the data set by a couple of fields, calculate the mean and standard deviation from the mean for an arbitrary time span (say, 15 days before the data point being plotted) and plot all 3 on one graph.

The attached image is similar to what I'm looking for, but I'm having a hard time figuring out how to do this without using trendlines.

[bshuler_splunk]

If you want multiple values plotted in the line chart, specify multiple functions for the time chart.

Try this:

index=_internal group=pipeline name=indexerpipe processor=indexer| timechart mean(write_cpu_seconds) as mean stdev(write_cpu_seconds) as stdev perc95(write_cpu_seconds) as perc95

[martin_mueller]

It's probably entirely different from what you're trying to do, but give this a shot:

sourcetype=farequote airline=AAL | timechart bins=250 avg(responsetime) as responsetime | predict responsetime