sourcetype="jboss" TOTAL SEARCH TIME CAREWEB AND NOT PMR earliest=-24h@h latest=@h | eval rp=EASYDOC_JBOSS_TIME/1000 | bucket _time span=1h | stats avg(rp) as avgRP by _time | eval series = "average RP" | append [ search sourcetype="jboss" TOTAL SEARCH TIME CAREWEB AND NOT PMR earliest=-29d latest=@h | eval rp=EASYDOC_JBOSS_TIME/1000 | timechart count span=1h | streamstats window=168 avg(rp) as avgRP | eval series = "moving avg RP" | fields _time, avgRP, series ] | where _time > relative_time(now(),"-24h@h") | timechart span=1h max(avgRP) as "Average RP" by series
There are some dates in this search that you probably need to adjust:
window=168because 2 weeks = 7*24 hours = 168 hours, so thats what streamstats needs to compute the moving average. You may not need to change this.
earliest=-24h@hin the first search. I just wanted to make the search time range explicit, so that the whole search makes sense. You could use the dropdown time range picker in the UI instead. But if you choose a different time range, you will definitely need to adjust the remaining time ranges in this list
earliest=-16din the inner search. This should be set to at least 2 weeks + the time period in the first search. You may want to play with this a bit; i added an extra day to avoid having to worry about partial days.
where _time > relative_time(now(),"-24h@h")- this statement eliminates the extra events that are created by the inner search while computing the rolling average. The
-24h@hmust be the same time range as in the first search.
By default, the inner search will run over all time, so you really do need to constrain the time range of the inner search.
Let me know if this works!
I am getting an error for the following line. It is complaining that "Error in 'eval' command: The operator at 'fields _time avgRP, series' is invalid"
eval series = "moving avg RP"
fields _time, avgRP, series