Splunk Search

Plotting 2 week moving average for response data

kunadkat
Explorer

I am plotting reponse time data using the following search

sourcetype="jboss" TOTAL SEARCH TIME CAREWEB AND NOT PMR | eval rp=EASYDOC_JBOSS_TIME/1000 | timechart span="1h" avg(rp)

Is is possible to plot 2 week moving average as a base line with this chart

Tags (3)
0 Karma

lguinn2
Legend
sourcetype="jboss" TOTAL SEARCH TIME CAREWEB AND NOT PMR earliest=-24h@h latest=@h | 
eval rp=EASYDOC_JBOSS_TIME/1000 | 
bucket _time span=1h |
stats avg(rp) as avgRP by _time |
eval series = "average RP" |
append [ search 
sourcetype="jboss" TOTAL SEARCH TIME CAREWEB AND NOT PMR earliest=-29d latest=@h | 
eval rp=EASYDOC_JBOSS_TIME/1000 | 
timechart count span=1h | 
streamstats window=168 avg(rp) as avgRP |
eval series = "moving avg RP" |
fields _time, avgRP, series ] |
where _time > relative_time(now(),"-24h@h") |
timechart span=1h max(avgRP) as "Average RP" by series

There are some dates in this search that you probably need to adjust:

  • window=168 because 2 weeks = 7*24 hours = 168 hours, so thats what streamstats needs to compute the moving average. You may not need to change this.
  • earliest=-24h@h in the first search. I just wanted to make the search time range explicit, so that the whole search makes sense. You could use the dropdown time range picker in the UI instead. But if you choose a different time range, you will definitely need to adjust the remaining time ranges in this list
  • earliest=-16d in the inner search. This should be set to at least 2 weeks + the time period in the first search. You may want to play with this a bit; i added an extra day to avoid having to worry about partial days.
  • where _time > relative_time(now(),"-24h@h") - this statement eliminates the extra events that are created by the inner search while computing the rolling average. The -24h@h must be the same time range as in the first search.

By default, the inner search will run over all time, so you really do need to constrain the time range of the inner search.

Let me know if this works!

0 Karma

lguinn2
Legend

Oops, missing a pipe! I edited my answer above.

0 Karma

kunadkat
Explorer

I am getting an error for the following line. It is complaining that "Error in 'eval' command: The operator at 'fields _time avgRP, series' is invalid"

eval series = "moving avg RP"
fields _time, avgRP, series

Thanks,

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...