Hello,
Using Splunk Enterprise 6.2
I am running a prediction using 30+ historical days of data to predict the next 24 hours of a week day of a particular transaction's volume.
When creating the timechart, I do not want to show all 30+ days of data, but I still want to leverage that data in the prediction for the next 24-hour period. I need to limit the displayed time range to something like earliest=-48
and latest=+24h
, constantly rolling around the time period of "now".
I am not having any luck with XML edits, such as "charting.axisX.minimumTime"/"charting.axisX.maximumTime".
Thanks,
-J
After your timechart and predict, you can add | where _time >= relative_time(now(), "-48h")
to filter the results.
After your timechart and predict, you can add | where _time >= relative_time(now(), "-48h")
to filter the results.
Perfect, thank you for the prompt response!
I am double checking to make sure there are no discrepancies with/without the |where comment above, but prelim is showing exactly what I needed.
yup, matched fine. Thanks again.