troublesome charting

[tuxford]

Hello

I have a chart that works for a time range of 60 minutes and looks like this:

sourcetype="access_combined" "*.html" OR ".ajax" NOT "/tomcat-docs/healthcheck.html" | where other>0 | eval avg_sec=other/1000 | chart avg(avg_sec) by date_minute

This gives me an average for each minute of that hour, I would like to do the same for longer time periods but are unable to find out how. If I extend the time range it sums the same minutes for each hour and makes an average of that instead of treating every minute of each hour as a separate entity. Anyone know a fix?

[Paolo_Prigione · Accepted solution]

You should use the timechart command

sourcetype="access_combined" "*.html" OR ".ajax" NOT "/tomcat-docs/healthcheck.html" | where other>0  | eval avg_sec=other/1000 | timechart span=1m avg(avg_sec)

[Paolo_Prigione]

The x axis can plot max 1000 points, and there are 1440 mins in a day. So it might be too wide. However, try to use "stats" to be sure you're getting the averages correct: sourcetype="access_combined" "*.html" OR ".ajax" NOT "/tomcat-docs/healthcheck.html" | where other>0 | eval avg_sec=other/1000 | bucket _time span=1m | stat avg(avg_sec)

[tuxford]

Yes, I've tried a lot of different ways now limited success. Basically what I want is to create an average that spans 1 minute in a larger time range where the chart is shown in a good way. It might be that my time range is too large when using a span of 1 minute and it simply won't work?

[Paolo_Prigione]

Have you tried to modify the way charts deal with nulls? You might try "treat as zeros".

[tuxford]

Still seeing some odd results, seems the results change depending on how long the time range is, if I use 4 hours I get peaks around 30 and when I use 24 hours I only get peaks around 12 so the average calculations seems to differ somehow.