This seems to me like it should be super simple (looker, tableau, etc) but I've been working at this for almost 2 days and I'm getting nowhere, I would be very appreciative if anyone could help. I'm trying to get: Chart the percentage difference between count of _time (ie. count of records) and a simple moving average of the last 5 days on the Y axis and time (spans) on the X, where response_code>200 by path I'll paste an example of where I'm at, but I know I'm not even close. Can I get any tips please?     index=k8s_events namespace=ecom-middleware NOT method=OPTIONS response_code>200 | streamstats avg(count(_time)) as cTime window=5 | table _time path cTime | timechart usenull=f span=8h avg(cTime) By path     ... View more