The Splunk search you ran in this recipe can be modified to make use of the timechart command and all of the functions it has to offer. Using the Visualization tab and scatter chart, run the following Splunk search over Last 24 hours:
index=main sourcetype=access_combined | eval kb=bytes/1024 | timechart span=5m mean(kb) min(kb) max(kb)
As you can see, with the timechart command, you are first bucketing the events into five-minute intervals as specified by the span parameter. Next, the mean, min, and max values of the kb field for that given time span are calculated. This way, if there is an identified discrete value, you can see more clearly what drove that span of events to be discrete. ...
