User talk:Firebus

No tag
sourcetype=access*
 * timechart avg(bytes) as avg_bytes
 * trendline sma5(avg_bytes) as moving_avg_bytes
 * eval spike=if(avg_bytes > 2 * moving_avg_bytes, 10000, 0)

div on own line
sourcetype=access*
 * timechart avg(bytes) as avg_bytes
 * trendline sma5(avg_bytes) as moving_avg_bytes
 * eval spike=if(avg_bytes > 2 * moving_avg_bytes, 10000, 0)

div on same line as content
sourcetype=access*
 * timechart avg(bytes) as avg_bytes
 * trendline sma5(avg_bytes) as moving_avg_bytes
 * eval spike=if(avg_bytes > 2 * moving_avg_bytes, 10000, 0)

p on same line as content
sourcetype=access*
 * timechart avg(bytes) as avg_bytes
 * trendline sma5(avg_bytes) as moving_avg_bytes
 * eval spike=if(avg_bytes > 2 * moving_avg_bytes, 10000, 0)