I am new to periodic function. I am performing some R&D on existing file "souvenir_sales.csv". I am keeping only first 10-12 records and removing others to see the timechart but I get error "command="predict", data is not periodic". I also copied the original file and then modified sales column for first 10 records with any random values(deleting all below records) and I still get same error. I am using below command: | inputlookup souvenir_sales.csv | eval _time=strptime(Month, "%Y-%m-%d") | timechart span=1mon values(sales) as sales| predict "sales" as prediction algorithm=LLP holdback=0 future_timespan=24 upper95=upper95 lower95=lower95 | forecastviz(24, 0, "sales", 95) ... View more

I am retrieving two time fields one from main query and other from subquery. When I subtract both fields, I get blank output. Query I am using: index=main host=* *CRgsSessionInfo* PrimaryUserLogin=PrimaryUserLogOn | eval Time = _time | append [search host=* *CRgsSessionInfo PrimaryUserLogin=PrimaryUserLogoff | eval Time1 = _time ] | eval Diff= Time1-Time |table Diff marked code. dmj ... View more