use splunkd metrics eps and 7 day average

[EricPartington]

I would like start setting baselines for devices that are sending logs to splunk.
An example:
using splunkd metrics group_by_host
chart the last 24 hours using span of 1hr the average eps value by host

index=_internal sourcetype=splunkd metrics group="per_host_thruput" series=server1 | timechart span=1h avg(eps) by series

on top of that i would like to chart the 7day average value of eps for that same host as a constant on the same chart (-7d@d to -d@d)
Initially using the raw data, eventually using summary index for storing the hourly or daily average(eps) to report quickly (using hourly for last 7dx24hr or daily for last 7 days).
looking to eventually use this to show if traffic patterns are above normal (trending for last 7d, 30d etc). also reporting for traffic above or below normal for extended period of time.
thoughts ?

have looked at trendline, streamstats and appending a static value but cant seem to get started on the right path.

[_d_ · Accepted solution]

I would (strongly) recommend taking a look at the Deployment Monitor app that now ships with Splunk. It contains very detailed statistics and dashboards/charts on forwarders, indexers, throughput, searches, license usage, volume reporting etc. It will also give you ideas on creating customized charts.
Link: http://splunk-base.splunk.com/apps/22301/splunk-deployment-monitor

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!

[EricPartington]

already using deployment monitor successfully

thanks for the hints on using that as a template to change.