Hi guys,
I am trying to compute and chart the cumulative moving average (ref. of what is it:https://en.wikipedia.org/wiki/Moving_average#Cumulative_moving_average)
The point is that I am doing the following query:
host=SARITA source="login.csv" | reverse | accum elapsed_time as cumulative_elapsed_time | timechart span=5h last(cumulative_elapsed_time) by server
And what I get from it is the cumulative sum. Now what I still need is to get cumulative count (which means, for any "n" value, to get the amount n up to that point in time, but not the total amount of values of all that series), so I can divide the cumulative value by the cumulative count, thus having the cumulative average.
Please help me with this, as I am really stuck on it. Thank you very much in advance for your patience.
Best regards,
Brian
↧