Using Splunk Enterprise 6.2
I am running a prediction using 30+ historical days of data to predict the next 24 hours of a week day of a particular transaction's volume.
When creating the timechart, I do not want to show all 30+ days of data, but I still want to leverage that data in the prediction for the next 24-hour period. I need to limit the displayed time range to something like
latest=+24h, constantly rolling around the time period of "now".
I am not having any luck with XML edits, such as "charting.axisX.minimumTime"/"charting.axisX.maximumTime".
Perfect, thank you for the prompt response!
I am double checking to make sure there are no discrepancies with/without the |where comment above, but prelim is showing exactly what I needed.