I have no clue how to do this. I've tried autoregress, and I expect it shoudl work, but I end up with gaps in the new field...the original field is continuous.
What I want to do is get stats on the most recent 5 events in my search, and then grab the same stats for the previous 5 events. I can get something close if I do it on a time-basis, but I really want to do this on a event-basis. What I'd like to do is retrieve 10 events in my search (not hard to do) then operate on the first 5 and the last 5 as two distinct groupings of values.
In order to split a call to stats by groups of five events you could do something like this:
your search pipeline that yields a multiple of five events | streamstats current=f count as segment | eval segment = floor(segment / 5) | stats foo(bar) by segment
The field segment will be 0 for the first five events, 1 for the second five, and so on.