Archive

Use of autoregress and large time range, but limit results of final search to smaller time range

New Member

I am trying to make a chart using autoregress with the previous 365 values/days... My time range needs to be at least 730 days to gather the proper data. This works fine, but I only want the chart display the most recent 365 days, not the entire 730 days (because the first 365 days were only needed to create the data for the autoregress).

Any advice is appreciated!

  • Charles
Tags (1)
0 Karma
2 Solutions

Splunk Employee
Splunk Employee

The simple version I think is to just add:

... | where _time >= relative_time(now(),"-365d@d")

to your search. You could also add:

... | addinfo 
    | where _time >= relative_time(info_max_time,"-365d@d") 
    | fields - info_min_time info_max_time info_search_id info_search_time

if you run the report from periods other than now.

View solution in original post

Splunk Employee
Splunk Employee

Assuming that you have a row for each day, you could also just hardcode getting the last 365 rows, i.e. ... | tail 365 | reverse

(you need the reverse because tail will be an implicit reverse, and I assume you want it back in ascending time order)

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

Assuming that you have a row for each day, you could also just hardcode getting the last 365 rows, i.e. ... | tail 365 | reverse

(you need the reverse because tail will be an implicit reverse, and I assume you want it back in ascending time order)

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

The simple version I think is to just add:

... | where _time >= relative_time(now(),"-365d@d")

to your search. You could also add:

... | addinfo 
    | where _time >= relative_time(info_max_time,"-365d@d") 
    | fields - info_min_time info_max_time info_search_id info_search_time

if you run the report from periods other than now.

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!