stats for a given time range for last 30 days

[adoshi]

I would like to get an average of a any given value for a time range say 7:00 PM to 8:00 PM over last 30 days.

Would I need to use sum(eval(if(_Time >= StartTime,if (_time<=EndTime,ValueToSum,0),0) and then calculate the average?

[ak]

that's one of doing it.

I would suggest building it as follows:

1. specify fields earliest,latest to narrow the range
2. use the where command to limit the start/end times of each day, further narrowing your dataset
3. apply the stats command across that range

for example


earliest=-31d latest=-1d | where strftime(_time, "%H") > "18" AND strftime(_time, "%H") < "21" | stats count(FIELD) over _time

[adoshi]

Thank you. I am planning to use this in a monitoring scenario so if error counts in last 30 minutes increase more than the 30 day average (during the same 30 minutes) then we have a problem. So would you recommend sticking to rounded 30 minutes or do last 30 minutes?