How do I constrain a timechart's x-axis range, but still predict on more values than are displayed?

[j_williams]

Hello,

Using Splunk Enterprise 6.2

I am running a prediction using 30+ historical days of data to predict the next 24 hours of a week day of a particular transaction's volume.

When creating the timechart, I do not want to show all 30+ days of data, but I still want to leverage that data in the prediction for the next 24-hour period. I need to limit the displayed time range to something like earliest=-48 and latest=+24h, constantly rolling around the time period of "now".

I am not having any luck with XML edits, such as "charting.axisX.minimumTime"/"charting.axisX.maximumTime".

Thanks,

-J

[martin_mueller · Accepted solution]

After your timechart and predict, you can add | where _time >= relative_time(now(), "-48h") to filter the results.

[j_williams]

Perfect, thank you for the prompt response!
I am double checking to make sure there are no discrepancies with/without the |where comment above, but prelim is showing exactly what I needed.

[j_williams]

yup, matched fine. Thanks again.