I have a timechart where I am getting the average of user actions. What I would like to do is have this run for the past 24 hours but have also the historical 30 day or so trendline incorporated. I was attempting something like the following:
| append [ timechart avg(usertime) by usercomponentspan=15m limit=0]
| timechart avg(usertime) by usercomponent span=4week
| timewrap 4week
This doesnt get to where I want though. Additionally I was thinking of creating a trendline but in trying that I cant get it to go back historically beyond my time-range. Is there a better way to accomplish this?
You can probably create a saved search which runs every day and fetches last 30 days data and does the
timechart and updates a
lookup which then you can use in the search which is run for
last 24 hours data. The data in the lookup can server your purpose for a
trendline . The benefit of doing this way is you dont have to run the search for last 30 days which will slowdown your overall search.
Saved search for the lookup : index=yourindex earliest=-30d@d | timechart span=4w dc(hdr.userId) as username by user_component limit=0 | outlookup append=false lookupname.csv Your search for the dashboard : `index=yourindex earliest=-24h@h | timechart span=15m dc(hdr.userId) as username by user_component limit=0 | inputlookup append=true lookupname.csv`
Ideally I did not want to use a lookup. Eventually I would like this fed into a dashboard which has some tokens fed in which would result in multiple lookups being maintained.
what kind of scenarios you can think of which can stop you from using lookup. I understand using multiple looks for doing the similar things is not a good idea.