Is there a visualization of the _time and alerts issues?

[danielbb]

Is there a visualization of the _time and alerts issues, such as the one described at How to alert using _indextime for window instead of _time ?

I need to visually show it to the managers here.

[woodcock]

First, set your Timepicker on the Advanced tab and set Earliest to 0 and Latest to +Infinty (NOTE: DO NOT use All Time because in some versions of Splunk it uses now for Latest instead of +Infinity). Next use a search like this:

index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="AndSourcetypeToo" _index_earliest=-6m@m _index_latest=-5m ...

[richgalloway]

What "time and alerts issues" are you talking about?
What difficulty are you having modifying the search in the cited answer to suit your needs?

[danielbb]

The issue is described at the link - when to use _indextime in alerts in addition to _time. Is there a visualization that shows how they can be used in alerts?

[niketn]

@danielbb check out Timeline Custom Visualization