So I have some data which looks similar to this:
time="timevalue", name="name", measurement="value"
And I have 7 different values for name (i.e., name1, name2, etc.)
How can I group the data together so that, on the same trendline (graphing averages), it has the groups
{name1, name2}
{name3, name4, name5, name6, name7}
And performs my calculations on those.
The search right now returns an average of all events:
base search
| timechart span=12h values(measurement) as Measurement
| streamstats window=180 AVG
| table _time AVG*
... View more