Single trend values from day to day

[neilhiley]

Hi. I want to display two figures of the total avg per day and display from previous day. With showing a percentage in green or red weather its better or worse than the day before...

My current search is like

......... | bucket _time span=1d | stats avg(msecs) AS Total_avg

This displays total average how do I display figures for each month.

[HeinzWaescher]

You can use a timechart to calculate the averages and the streamstats command to calculate a daily ratio:

 ...| timechart span=1d avg(msecs) AS avg
 | streamstats current=f global=f window=1 latest(avg) as previous_day_avg
 | eval ratio=round(avg/previous_day_avg,2)

To do it per month use:
| timechart span=1mon avg(msecs) AS avg