https://community.splunk.com/t5/Splunk-Search/Displaying-chart-in-real-time-with-fixed-earliest-latest/m-p/175907#M50518 <P>Have you read the document at the link provided? It says that you can't use <CODE>earliest=rt-1d@d</CODE> or something like that <EM>within</EM> your search string. You can however place such a setting in times.conf to add them to the time range picker as a preset. That way, you can select a real-time search for the main search. Sadly, this is still not exactly what you asked for, because it doesn't contain the <CODE>@d+9h</CODE> offset.<BR /> I had another idea for that: you could calculate the seconds passed since midnight and see if that number is between 32400 and 61200, like this:</P> <PRE><CODE>| eval e_day=strptime(strftime(_time, "%y %m %d"), "%y %m %d") | eval t_today=_time-e_day | where t_today&gt;32400 AND t_today&lt;61200 </CODE></PRE> Fri, 21 Aug 2015 07:33:01 GMT jeffland 2015-08-21T07:33:01Z https://community.splunk.com/t5/Splunk-Search/Displaying-chart-in-real-time-with-fixed-earliest-latest/m-p/175902#M50513 <P>I have a query that overlays the value of one date with the value of another date, it is put together as this:</P> <PRE><CODE>... earliest=@d+9h latest=@d+17h ... | appendcols [ ... earliest=someDate:09:00:00 latest=someDate:17:00:00 ... ] </CODE></PRE> <P>The time frame is set to "All time" since someDate can be any date and is input as a result of drop downs. I would like to show the value of the first search in real time, how would this be done? I'm thinking about force updating the chart each 1 minute or something... "All time (real-time)" doesn't work as it only displays the value from when the search is done and forward.</P> <P>Can I replace @d+9h with some dynamic solution to just show the value between business hours?</P> Mon, 17 Aug 2015 13:42:29 GMT https://community.splunk.com/t5/Splunk-Search/Displaying-chart-in-real-time-with-fixed-earliest-latest/m-p/175902#M50513 ohlafl 2015-08-17T13:42:29Z https://community.splunk.com/t5/Splunk-Search/Displaying-chart-in-real-time-with-fixed-earliest-latest/m-p/175903#M50514 <P>Any ideas on this?</P> Tue, 18 Aug 2015 13:26:43 GMT https://community.splunk.com/t5/Splunk-Search/Displaying-chart-in-real-time-with-fixed-earliest-latest/m-p/175903#M50514 ohlafl 2015-08-18T13:26:43Z https://community.splunk.com/t5/Splunk-Search/Displaying-chart-in-real-time-with-fixed-earliest-latest/m-p/175904#M50515 <P>Still nothing? Perhaps it is not possible. Karma awarded!</P> Thu, 20 Aug 2015 11:32:14 GMT https://community.splunk.com/t5/Splunk-Search/Displaying-chart-in-real-time-with-fixed-earliest-latest/m-p/175904#M50515 ohlafl 2015-08-20T11:32:14Z https://community.splunk.com/t5/Splunk-Search/Displaying-chart-in-real-time-with-fixed-earliest-latest/m-p/175905#M50516 <P>Well, the obvious solution to update the dashboard is to add <CODE>refresh = seconds</CODE> to your <CODE>dashboard</CODE> or <CODE>form</CODE> tag, e.g.</P> <PRE><CODE>&lt;dashboard refresh="60"&gt; &lt;row&gt; ... </CODE></PRE> <H2>You can also do this only with specific panels with <CODE>refresh.auto.interval</CODE>, see <A href="http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML">here</A> for the Simple XML reference.</H2> <P>PS: using <CODE>earliest</CODE> and <CODE>latest</CODE> with real-time search ranges directly in a search is not supported as described <A href="http://docs.splunk.com/Documentation/Splunk/6.2.5/Search/Specifyrealtimewindowsinyoursearch">here</A>. You could however define a time range picker option and select that; you can then specify another non-real-time range with <CODE>earliest</CODE> and <CODE>latest</CODE> for your subsearch.</P> Thu, 20 Aug 2015 12:23:35 GMT https://community.splunk.com/t5/Splunk-Search/Displaying-chart-in-real-time-with-fixed-earliest-latest/m-p/175905#M50516 jeffland 2015-08-20T12:23:35Z https://community.splunk.com/t5/Splunk-Search/Displaying-chart-in-real-time-with-fixed-earliest-latest/m-p/175906#M50517 <P>Ah, that auto-refresh feature is really nice. I don't really understand the PS part but I think that would be even better? Could you possibly give an example?</P> Thu, 20 Aug 2015 12:52:50 GMT https://community.splunk.com/t5/Splunk-Search/Displaying-chart-in-real-time-with-fixed-earliest-latest/m-p/175906#M50517 ohlafl 2015-08-20T12:52:50Z https://community.splunk.com/t5/Splunk-Search/Displaying-chart-in-real-time-with-fixed-earliest-latest/m-p/175907#M50518 <P>Have you read the document at the link provided? It says that you can't use <CODE>earliest=rt-1d@d</CODE> or something like that <EM>within</EM> your search string. You can however place such a setting in times.conf to add them to the time range picker as a preset. That way, you can select a real-time search for the main search. Sadly, this is still not exactly what you asked for, because it doesn't contain the <CODE>@d+9h</CODE> offset.<BR /> I had another idea for that: you could calculate the seconds passed since midnight and see if that number is between 32400 and 61200, like this:</P> <PRE><CODE>| eval e_day=strptime(strftime(_time, "%y %m %d"), "%y %m %d") | eval t_today=_time-e_day | where t_today&gt;32400 AND t_today&lt;61200 </CODE></PRE> Fri, 21 Aug 2015 07:33:01 GMT https://community.splunk.com/t5/Splunk-Search/Displaying-chart-in-real-time-with-fixed-earliest-latest/m-p/175907#M50518 jeffland 2015-08-21T07:33:01Z