I'm trying to build a series of trendlines split by day of week. Unfortunately the trendline command does not accept a "by" clause. Has anyone ever came across a solution?
Example in detail: I have a search that calculates events over weekdays (so we can see which day is busiest), but this can work the same for hour of day of any repeating patterns:
This is fine to calculate the average per weekday since the beginning of the year. However I want to give more weight to recent weeks, rather then a simple average that includes "dead" periods of activity (think semester break).
Any help on how to achieve this would be appreciated! (And if anyone from Splunk is listening - it would be a great new feature! :)
asked 03 Jun '12, 18:32