Reporting

How to use Report Acceleration in a Dashboard

Engager

I have a base report "Hourly Checkpoint Blocks" for a time span of 1 hour that I have accelerated for 1 month.
I.E.
index=checkpoint action=block
| timechart count by action

I have created a dashboard and added a New Panel from Reports and selected the "Hourly Checkpoint Blocks" report.

The dashboard shows data for the report, only 1 hour.

How do I use the report for a 30 day time span?

0 Karma

SplunkTrust
SplunkTrust

try this:

index=checkpoint action=block earliest=-30d@d latest=now
| timechart count by action
0 Karma