Dashboards & Visualizations

Is there a visualization of the _time and alerts issues?


Is there a visualization of the _time and alerts issues, such as the one described at How to alert using _indextime for window instead of _time ?

I need to visually show it to the managers here.

Tags (2)
0 Karma

Esteemed Legend

First, set your Timepicker on the Advanced tab and set Earliest to 0 and Latest to +Infinty (NOTE: DO NOT use All Time because in some versions of Splunk it uses now for Latest instead of +Infinity). Next use a search like this:

index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="AndSourcetypeToo" _index_earliest=-6m@m _index_latest=-5m ...


What "time and alerts issues" are you talking about?
What difficulty are you having modifying the search in the cited answer to suit your needs?

If this reply helps you, an upvote would be appreciated.


The issue is described at the link - when to use _indextime in alerts in addition to _time. Is there a visualization that shows how they can be used in alerts?

0 Karma


@danielbb check out Timeline Custom Visualization

| makeresults | eval message= "Happy Splunking!!!"
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!