| makeresults count=2
| streamstats count
| eval _time = if (count==2,relative_time(_time,"-2h@m"), relative_time(_time,"@m"))
| makecontinuous span=15s _time
| eval host="host".(random() % 5 + 1)
| timechart span=5m count as event_count by host
| rename COMMENT as "this is sample you provide"
| rename COMMENT as "from here, the logic"
| eval tmp=""
| foreach host*
[eval tmp=mvappend(tmp,<<FIELD>>)
| eval _n=mvcount(tmp) - 1]
| table _* host*
| streamstats current=f window=2 stdev(*) as *_past10min_stdv
| foreach host*_past10min_stdv
[eval <<FIELD>>2= 2 * '<<FIELD>>']
| reverse
| rename _n as n
Hi, @dyuen
I did the calculation.
However, since the data is a random number, I can't get a proper number.
please provide sample.
... View more
