SPL
Baselining Dashboard
Description
This is better and more flexible option then timewrap in my opinion. Performance ain't too shabby either.
2 0
index=foo earliest=-1d latest=now | timechart span=10m count as Current | appendcols [ search index=foo earliest=-1mon-1d latest=-mon | timechart span=10m count as "-1 Month"] | appendcols [ search index=foo earliest=-1w-1d latest=-w | timechart span=10m count as "-1 Week"]
Comments
0 total
Be the first to comment on this SPL.
Leave a comment
You must log in to post a comment.