Used with timeChart() or bucket(), computes the aggregate for one or more fields over a sliding window of data. This function can only be used as the function argument with timeChart() or bucket(). If used elsewhere, an error is reported to the user.

The window() computes the running aggregate (e.g. avg() or sum()) for the given incoming events. For each window, the window() takes the buckets parameter and uses this to calculate the rolling aggregate across that number of buckets in the input.

For example, this query calculates the rolling average over the preceding three buckets in the humio for allocBytes:

timechart(span=15s,function=window(function=avg(allocBytes), buckets=3))
|formatTime(field=_bucket,format="%T",as=fmttime)

A graphical representation, showing the span of each computed window is shown below.

By comparison this query computes the value over the preceding 5 buckets:

timechart(span=15s,function=window(function=avg(allocBytes), buckets=3))
|formatTime(field=_bucket,format="%T",as=fmttime)

The computed average is different because a different series of values in different buckets is being used to compute the value:

This can be represented graphically like this:

If the number of buckets required by the sliding window to compute its aggregate result is higher than the number of buckets provided by the surrounding timeChart() or bucket() function, then the window() function will yield an empty result.

Any aggregate function can be used to compute sliding window data.

An example use case would be to find outliers, comparing a running average +/- running standard deviations to the concrete min/max values. This can be obtained by computing like this, which graphs the max value vs the limit value computed as average plus two standard deviations over the previous 15 minutes.

| timeChart(function=[max(m1),window([stdDev(m1),avg(m1)], span=15min)])
| groupBy(_bucket, function={ limit := _avg+2*_stddev
| table([_max, limit]) })

timeChart(host, function=window( function=avg(cpu_load), span=30min ))

timeChart(host, function=window( function=[avg(cpu_load), max(cpu_load)], buckets=3 ), span=10m)