Plotting 2 week moving average for response data

[kunadkat]

I am plotting reponse time data using the following search

sourcetype="jboss" TOTAL SEARCH TIME CAREWEB AND NOT PMR | eval rp=EASYDOC_JBOSS_TIME/1000 | timechart span="1h" avg(rp)

Is is possible to plot 2 week moving average as a base line with this chart

[lguinn2]

sourcetype="jboss" TOTAL SEARCH TIME CAREWEB AND NOT PMR earliest=-24h@h latest=@h | 
eval rp=EASYDOC_JBOSS_TIME/1000 | 
bucket _time span=1h |
stats avg(rp) as avgRP by _time |
eval series = "average RP" |
append [ search 
sourcetype="jboss" TOTAL SEARCH TIME CAREWEB AND NOT PMR earliest=-29d latest=@h | 
eval rp=EASYDOC_JBOSS_TIME/1000 | 
timechart count span=1h | 
streamstats window=168 avg(rp) as avgRP |
eval series = "moving avg RP" |
fields _time, avgRP, series ] |
where _time > relative_time(now(),"-24h@h") |
timechart span=1h max(avgRP) as "Average RP" by series

There are some dates in this search that you probably need to adjust:

• window=168 because 2 weeks = 7*24 hours = 168 hours, so thats what streamstats needs to compute the moving average. You may not need to change this.
• earliest=-24h@h in the first search. I just wanted to make the search time range explicit, so that the whole search makes sense. You could use the dropdown time range picker in the UI instead. But if you choose a different time range, you will definitely need to adjust the remaining time ranges in this list
• earliest=-16d in the inner search. This should be set to at least 2 weeks + the time period in the first search. You may want to play with this a bit; i added an extra day to avoid having to worry about partial days.
• where _time > relative_time(now(),"-24h@h") - this statement eliminates the extra events that are created by the inner search while computing the rolling average. The -24h@h must be the same time range as in the first search.

By default, the inner search will run over all time, so you really do need to constrain the time range of the inner search.

Let me know if this works!

[lguinn2]

Oops, missing a pipe! I edited my answer above.

[kunadkat]

I am getting an error for the following line. It is complaining that "Error in 'eval' command: The operator at 'fields _time avgRP, series' is invalid"

eval series = "moving avg RP"
fields _time, avgRP, series

Thanks,