Reporting

How to use Report Acceleration in a Dashboard

glasscoj
Engager

I have a base report "Hourly Checkpoint Blocks" for a time span of 1 hour that I have accelerated for 1 month.
I.E.
index=checkpoint action=block
| timechart count by action

I have created a dashboard and added a New Panel from Reports and selected the "Hourly Checkpoint Blocks" report.

The dashboard shows data for the report, only 1 hour.

How do I use the report for a 30 day time span?

0 Karma

mayurr98
Super Champion

try this:

index=checkpoint action=block earliest=-30d@d latest=now
| timechart count by action
0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...