topic How do I constrain a timechart's x-axis range, but still predict on more values than are displayed? in Splunk Search

How do I constrain a timechart's x-axis range, but still predict on more values than are displayed?

j_williams — Mon, 28 Mar 2016 18:57:05 GMT

Hello,

Using Splunk Enterprise 6.2

I am running a prediction using 30+ historical days of data to predict the next 24 hours of a week day of a particular transaction's volume.

When creating the timechart, I do not want to show all 30+ days of data, but I still want to leverage that data in the prediction for the next 24-hour period. I need to limit the displayed time range to something like earliest=-48 and latest=+24h, constantly rolling around the time period of "now".

I am not having any luck with XML edits, such as "charting.axisX.minimumTime"/"charting.axisX.maximumTime".

Thanks,

-J

Re: How do I constrain a timechart's x-axis range, but still predict on more values than are displayed?

martin_mueller — Mon, 28 Mar 2016 19:11:17 GMT

After your timechart and predict, you can add | where _time >= relative_time(now(), "-48h") to filter the results.

Re: How do I constrain a timechart's x-axis range, but still predict on more values than are displayed?

j_williams — Mon, 28 Mar 2016 19:28:49 GMT

Perfect, thank you for the prompt response!
I am double checking to make sure there are no discrepancies with/without the |where comment above, but prelim is showing exactly what I needed.

Re: How do I constrain a timechart's x-axis range, but still predict on more values than are displayed?

j_williams — Mon, 28 Mar 2016 21:19:51 GMT

yup, matched fine. Thanks again.