There's a quicker way with streamstats that may be new - here's how to get a 7 hour rolling average when splitting by host for example    <your base search> | timechart span=1h sum(foo) as s by host | untable _time host s | sort host _time | streamstats global=f window=7 avg(s) as trend by host | timechart span=1h max(trend) by host   ... View more