Hello,
Question first: How can I output an hourly prediction chart with the actuals and predicted values when the _time values are already bucketed by hour in the input data source?
I am running a prediction against the output of a scheduled report (optimizes on time). Prediction runs fine, output looks good, except the x-axis is missing.
The report I am inputting data from already has values bucketed in to hours. looks similar to this:
index=summary report=reporty.report
_time count
2016-03-30 13:00:00 555
2016-03-30 12:00:00 555
2016-03-30 11:00:00 555
2016-03-30 10:00:00 555
2016-03-30 09:00:00 555
2016-03-30 08:00:00 555
From that report, i then run prediction and output a line chart. Normally, to get the axis I would do something like
| timechart span=1h count | sort _time asc
However, with the hour buckets already aggregated, this does not show the correct values. Almost looks like it normalizes them instead of showing the raw values.
Thanks,
-J
↧