OK I figured this out. The reason why the timepicker date was being persisted was because of the following xml in the top of my code: isPersistable="true" I took this out and hey presto, it always reverted to default. ... View more

Do you want the moving average of the last X queries by type ? Or the moving average of each query by time ? If you take the average time for each query every minute, you'll end up with some minutes with 0. If you take the moving average over time, thats going to artificially lower your measurements. If you take the moving average of the last X queries by type, then the average at 6am might take into account queries that occured hours ago. Statistically - what are you trying to achieve ? Here's an example using the average time per query per minute as the starting point : This : bin _time span=1m chunks the data to the nearest minute. This : streamstats window=5 global=f avg(avg) as rolling by root takes the average (of the averages) for the last 5 minutes by the 'query' ( in this case root ). index=_internal sourcetype=*_access | bin _time span=1m | stats avg(spent) as avg by root,_time | streamstats window=5 global=f avg(avg) as rolling by root Now if you dont care about timechart re-averaging your values you can simply do : | timechart avg(avg) as avg avg(rolling) as rolling by root If you do care about timechart re-averaging your values : | eval s="avg rolling" | makemv s | mvexpand s | eval yval=case(s=="avg",avg,s=="rolling",rolling) | eval s=root.": ".s | xyseries _time, s, yval | makecontinuous _time You'll get far more meaningful readings by using something other than avg though. median or perc95 ... View more