@PickleRick
I've found that autoregress has far less applicability that the equivalent streamstats. The main 'limitation' autoregress has in my view is that is does not cope with any split by clause and in almost every case I have wanted to calculate moving averages, I have needed a split by clause.
Also, autoregress will just copy values from previous rows to the current row and if you still want to calculate ranges between those values, you must run a subsequent calculation to work out the difference, e.g. compare
index=_audit
| streamstats window=2 range(_time) as r
| autoregress _time as t p=1
| eval d=t-_time
| table _time r t d
@ITWhisperer example in your link showing streamstats with the window of 1 and then the eval, can be done with the window of 2 and the range() clause, as above.
As you can see from this split by clause, autoregress cannot handle the calculation of d when looking at the user.
index=_audit
| streamstats global=f window=2 range(_time) as r by user
| autoregress _time as t p=1
| eval d=t-_time
| table _time user r t d
As for performance, I've not tested comparisons for either, but both are centralized streaming commands, meaning both will run on the search head, so should always work on the smallest dataset possible.
autoregress is naturally an easy command to use, whereas streamstats with split by and all the flags, (current, global, reset*) make it powerful, but somewhat less intuitive.
