Splunk Search

Use of autoregress and large time range, but limit results of final search to smaller time range

charlessplunk
New Member

I am trying to make a chart using autoregress with the previous 365 values/days... My time range needs to be at least 730 days to gather the proper data. This works fine, but I only want the chart display the most recent 365 days, not the entire 730 days (because the first 365 days were only needed to create the data for the autoregress).

Any advice is appreciated!

  • Charles
Tags (1)
0 Karma
2 Solutions

gkanapathy
Splunk Employee
Splunk Employee

The simple version I think is to just add:

... | where _time >= relative_time(now(),"-365d@d")

to your search. You could also add:

... | addinfo 
    | where _time >= relative_time(info_max_time,"-365d@d") 
    | fields - info_min_time info_max_time info_search_id info_search_time

if you run the report from periods other than now.

View solution in original post

steveyz
Splunk Employee
Splunk Employee

Assuming that you have a row for each day, you could also just hardcode getting the last 365 rows, i.e. ... | tail 365 | reverse

(you need the reverse because tail will be an implicit reverse, and I assume you want it back in ascending time order)

View solution in original post

0 Karma

steveyz
Splunk Employee
Splunk Employee

Assuming that you have a row for each day, you could also just hardcode getting the last 365 rows, i.e. ... | tail 365 | reverse

(you need the reverse because tail will be an implicit reverse, and I assume you want it back in ascending time order)

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

The simple version I think is to just add:

... | where _time >= relative_time(now(),"-365d@d")

to your search. You could also add:

... | addinfo 
    | where _time >= relative_time(info_max_time,"-365d@d") 
    | fields - info_min_time info_max_time info_search_id info_search_time

if you run the report from periods other than now.

Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...