Refine your search:

Hi,

I'm trying to build a series of trendlines split by day of week. Unfortunately the trendline command does not accept a "by" clause. Has anyone ever came across a solution?

Example in detail: I have a search that calculates events over weekdays (so we can see which day is busiest), but this can work the same for hour of day of any repeating patterns:

search earliest=@y ... |
bucket span=1d _time | eval Day=strftime(_time, "%u. %A") |
stats count as countActions by _time, Day | 
stats avg(countActions) as "Weekday Average" by Day

This is fine to calculate the average per weekday since the beginning of the year. However I want to give more weight to recent weeks, rather then a simple average that includes "dead" periods of activity (think semester break).

A trendline wma5(countActions) by Day would have been great, except it doesn't work that way... The trendline command will take the results of the last X days for the moving average, but can not build the different series one for each weekday. All my attepts to use trendline just skew up weekend data with the previous weekdays. Apart from building seven independent graphs (which even then I would have trouble displaying together meaningfully), I can not think of any way to do this.

Any help on how to achieve this would be appreciated! (And if anyone from Splunk is listening - it would be a great new feature! :)

Cheers, Assaph

asked 03 Jun '12, 18:32

assaphmehr's gravatar image

assaphmehr
413
accept rate: 0%

Be the first one to answer this question!
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×14

Asked: 03 Jun '12, 18:32

Seen: 451 times

Last updated: 03 Jun '12, 18:32

Copyright © 2005-2012 Splunk Inc. All rights reserved.