sourcetype="jboss" TOTAL SEARCH TIME CAREWEB AND NOT PMR earliest=-24h@h latest=@h |
eval rp=EASYDOC_JBOSS_TIME/1000 |
bucket _time span=1h |
stats avg(rp) as avgRP by _time |
eval series = "average RP" |
append [ search
sourcetype="jboss" TOTAL SEARCH TIME CAREWEB AND NOT PMR earliest=-29d latest=@h |
eval rp=EASYDOC_JBOSS_TIME/1000 |
timechart count span=1h |
streamstats window=168 avg(rp) as avgRP |
eval series = "moving avg RP" |
fields _time, avgRP, series ] |
where _time > relative_time(now(),"-24h@h") |
timechart span=1h max(avgRP) as "Average RP" by series
There are some dates in this search that you probably need to adjust:
window=168
because 2 weeks = 7*24 hours = 168 hours, so thats what streamstats needs to compute the moving average. You may not need to change this.earliest=-24h@h
in the first search. I just wanted to make the search time range explicit, so that the whole search makes sense. You could use the dropdown time range picker in the UI instead. But if you choose a different time range, you will definitely need to adjust the remaining time ranges in this listearliest=-16d
in the inner search. This should be set to at least 2 weeks + the time period in the first search. You may want to play with this a bit; i added an extra day to avoid having to worry about partial days.where _time > relative_time(now(),"-24h@h")
- this statement eliminates the extra events that are created by the inner search while computing the rolling average. The -24h@h
must be the same time range as in the first search.By default, the inner search will run over all time, so you really do need to constrain the time range of the inner search.
Let me know if this works!
Oops, missing a pipe! I edited my answer above.
I am getting an error for the following line. It is complaining that "Error in 'eval' command: The operator at 'fields _time avgRP, series' is invalid"
eval series = "moving avg RP"
fields _time, avgRP, series
Thanks,