I have a dataset with some data points from a report I made; week end date(MM/DD/YYYY), host, user action, and average response time are the data-points. We have a large dataset so the run time is pretty long and we wanted to get rid of some noise and get a smoother line; really only looking for long term trends also. The idea was to average it out weekly into a data-set then graph the dataset. I am having some trouble getting the timechart to work with only using dataset data. Has anyone run into something like this? Run time is important as it will be housed in a dynamic dashboard with some selections.
In short can I timechart from only the dataset with weekly averages? Is there a better way to do this?
| lookup systemOverview.csv hostName as hostName OUTPUT _time as OVTime, component as component, WeekAvg as WeekAvg, Name AS Name
| timechart values(WeekAvg) by hostName
I was able to get the output I needed. Over thinking this but the following worked.
| inputlookup "systemVitals.csv"
I could then use the data I needed.
Like this:
|inputlookup systemOverview.csv
| sort 0 - _time
| timechart avg(WeekAvg) BY hostName
I was able to get the output I needed. Over thinking this but the following worked.
| inputlookup "systemVitals.csv"
I could then use the data I needed.
hello aohls, can you post your SPL? are you specifying 'span=1w' in your timechart?
@jschogel I have added my search I am attempting, not the original search into the dataset. I did not specify the span in my timechart I was trying. I will give that a shot.