I am using a bin command on _time field to have 10 minute sections of data. Like below:
|bin _time span=10m minspan=10m | stats sum(myField) as myField by _time
|streamstats avg(myfield) as avg by another field
I am trying to compare the most current value in the completed 10 minute block with the average of 10 minute blocks of data.
My understanding is that span should create 10 minute buckets on the data and minspan should filter out buckets that are not 10 minute yet. So if right now its 10.25 then the bucket that is for 10.20 should not be created. But that is not the case, I am getting the 10.20 bucket that has partial values data comparing to the average.
Any workaround or a better options or a much efficient way of doing this will be very helpful.
Thanks in advance!!
↧