Thanks for the information @Tom_Lundie. Unfortunately, changing the span skews the results when creating graphs of these metrics. If the span is not left at 5 minutes the rate average changes and does not display spikes accurately. I'm wondering if it would be easier to record the max value for each day or week and use those values to build yearly the graph. Appending | stats max(*) AS "*" give me the highest record number for the search period. Now, the question that comes to mind is how can I take those snapshots and create a larger graph from them. For example, take the max value of data points over a 24 hour period for last seven days and create a graph with those data points. Display 7 (days) connected points on a single graph. Then, do the same thing for a month. Display 4 (each week) connected datapoints for the month. Finally, the end result would be a graph of the year. Show 52 (weeks) points on a graph. I am not 100% on the best way to achieve what I'm trying to do here which is create graphs based on network interface metrics. Refresh from my first post. Weekly and monthly graphs work fine doing it the way I am but when trying to create a graph for the year the results are truncated. Thanks.
... View more
