Splunk Search

Use of autoregress and large time range, but limit results of final search to smaller time range

charlessplunk
New Member

I am trying to make a chart using autoregress with the previous 365 values/days... My time range needs to be at least 730 days to gather the proper data. This works fine, but I only want the chart display the most recent 365 days, not the entire 730 days (because the first 365 days were only needed to create the data for the autoregress).

Any advice is appreciated!

  • Charles
Tags (1)
0 Karma
2 Solutions

gkanapathy
Splunk Employee
Splunk Employee

The simple version I think is to just add:

... | where _time >= relative_time(now(),"-365d@d")

to your search. You could also add:

... | addinfo 
    | where _time >= relative_time(info_max_time,"-365d@d") 
    | fields - info_min_time info_max_time info_search_id info_search_time

if you run the report from periods other than now.

View solution in original post

steveyz
Splunk Employee
Splunk Employee

Assuming that you have a row for each day, you could also just hardcode getting the last 365 rows, i.e. ... | tail 365 | reverse

(you need the reverse because tail will be an implicit reverse, and I assume you want it back in ascending time order)

View solution in original post

0 Karma

steveyz
Splunk Employee
Splunk Employee

Assuming that you have a row for each day, you could also just hardcode getting the last 365 rows, i.e. ... | tail 365 | reverse

(you need the reverse because tail will be an implicit reverse, and I assume you want it back in ascending time order)

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

The simple version I think is to just add:

... | where _time >= relative_time(now(),"-365d@d")

to your search. You could also add:

... | addinfo 
    | where _time >= relative_time(info_max_time,"-365d@d") 
    | fields - info_min_time info_max_time info_search_id info_search_time

if you run the report from periods other than now.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...