Dashboards & Visualizations

Is it possible to define eventtypes or tags directly to search results so the selected time range is used as a condition as well?

HeinzWaescher
Motivator

Hi,

is it possible to define eventtypes or tag directly to search results, so that the selected timerange is used as well as a condition?

I think it can be done by using the this kind of search string in the eventtype manager:

sourcetype=ABC eventname=error AND _time>1432684800 AND _time<1432771200 

But the described scenario above would be much easier to handle.

BR

Heinz

0 Karma
1 Solution

gabec09
Explorer

For eventtypes, I have been doing exactly what you are describing with no issues. I use this for my time range as it is a bit easier on the eyes.

host=myhost1 sourcetype=Source1  earliest="05/28/2015:08:00:00" latest="05/28/2015:12:00:00" 

View solution in original post

gabec09
Explorer

For eventtypes, I have been doing exactly what you are describing with no issues. I use this for my time range as it is a bit easier on the eyes.

host=myhost1 sourcetype=Source1  earliest="05/28/2015:08:00:00" latest="05/28/2015:12:00:00" 

HeinzWaescher
Motivator

Thanks, using these time formats is a good point!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...