Use of autoregress and large time range, but limit results of final search to smaller time range

[charlessplunk]

I am trying to make a chart using autoregress with the previous 365 values/days... My time range needs to be at least 730 days to gather the proper data. This works fine, but I only want the chart display the most recent 365 days, not the entire 730 days (because the first 365 days were only needed to create the data for the autoregress).

Any advice is appreciated!

• Charles

[gkanapathy · Accepted solution]

The simple version I think is to just add:

... | where _time >= relative_time(now(),"-365d@d")

to your search. You could also add:

... | addinfo 
    | where _time >= relative_time(info_max_time,"-365d@d") 
    | fields - info_min_time info_max_time info_search_id info_search_time

if you run the report from periods other than now.

[steveyz · Accepted solution]

Assuming that you have a row for each day, you could also just hardcode getting the last 365 rows, i.e. ... | tail 365 | reverse

(you need the reverse because tail will be an implicit reverse, and I assume you want it back in ascending time order)

[gkanapathy · Accepted solution]

The simple version I think is to just add:

... | where _time >= relative_time(now(),"-365d@d")

to your search. You could also add:

... | addinfo 
    | where _time >= relative_time(info_max_time,"-365d@d") 
    | fields - info_min_time info_max_time info_search_id info_search_time

if you run the report from periods other than now.