I'm wondering if the following is possible.
I have events with metrics sent every 10 minutes, so when I create a dashboard looking at the past 15 minutes I can see the "latest status". I can also do a "SUM" of a field over several events to see the "latest and updated SUM" this way.
However - If now I want to create a date histogram, for example, I want to know the same SUM yesterday, and the day before that, etc, I can't. because the SUM is on the entire time bucket. And what I need is to say "take specific time points, 24 hours apart, and for each time point just take the last 15 minutes".
Is this possible? if not - what do you think is the "shortest route" here? To have a script reading every 24 hours the relevant data fo the last 15 minutes, creating a single log every 24 hours with the aggregated data of the specific time period? anything shorter?