Baselining Dashboard

This is better and more flexible option then timewrap in my opinion. Performance ain’t too shabby either.

index=foo earliest=-1d latest=now 
| timechart span=10m count as Current 
| appendcols 
[ search index=foo earliest=-1mon-1d latest=-mon 
| timechart span=10m count as "-1 Month"] 
| appendcols 
[ search index=foo earliest=-1w-1d latest=-w 
| timechart span=10m count as "-1 Week"]
Share This:

Leave A Comment?