Timelion: comparison between today's results and the average of one month


I wish in a Timelion compare the results today with those of the month (the average of the month).
I did :

.es(timefield=@timestamp), .es(offset=-1M, timefield=@timestamp)

I do not know what exactly is the offset = -1M !! does it take the average of last month?

(Nick Peihl) #2

Hi Karam,

.es(timefield=@timestamp), .es(offset=-1M, timefield=@timestamp) creates separate series in the Timelion chart showing count aggregations for the current time range and the same time range minus one month. So if your time range is set to July 1 to July 6, the offset will add a series to the chart for June 1 to June 6.

You can change the aggregation to average by adding the metric=avg:<field> parameter to your expressions.

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.