I am using timelion to try to graph some data for my coworker that is very difficult to derive using excel. We are trying to get a rolling 6-month cumulative sum the unique number of support tickets that were filed for a given project over the past year. So each support ticket has a project it is filed against. Our approach was to take a cusum of two graphs, one for the year and one time shifted 6 months prior and subtract. We are using a weekly time slice
.es(index=db*,timefield=submitted_date, metric=cardinality:project,offset=-182d).cusum().subtract(.es(index=db*,timefield=submitted_date,metric=cardinality:project).cusum()).abs().label("Active projects in 6 month window")
The only problem is we need to use a 6 month interval for the cumulative sum but then show it weekly, it that makes sense. So the resulting graph's 1st data point would be the cumulative sum of the unique projects that had support tickets filed against them for the previous 6 months (from 18-months ago to 1 year ago). The next data point would be the week after's cumulative unique sum of projects from the previous 6 months (18 months ago + 1 week up to a year ago + 1 week), and so on. Is that possible to control the cusum bucket time interval while calculating and showing the data weekly?
Thanks