Dashboards & Visualizations

Is there a visualization of the _time and alerts issues?

danielbb
Motivator

Is there a visualization of the _time and alerts issues, such as the one described at How to alert using _indextime for window instead of _time ?

I need to visually show it to the managers here.

Tags (2)
0 Karma

woodcock
Esteemed Legend

First, set your Timepicker on the Advanced tab and set Earliest to 0 and Latest to +Infinty (NOTE: DO NOT use All Time because in some versions of Splunk it uses now for Latest instead of +Infinity). Next use a search like this:

index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="AndSourcetypeToo" _index_earliest=-6m@m _index_latest=-5m ...

richgalloway
SplunkTrust
SplunkTrust

What "time and alerts issues" are you talking about?
What difficulty are you having modifying the search in the cited answer to suit your needs?

---
If this reply helps you, an upvote would be appreciated.

danielbb
Motivator

The issue is described at the link - when to use _indextime in alerts in addition to _time. Is there a visualization that shows how they can be used in alerts?

0 Karma

niketnilay
Legend

@danielbb check out Timeline Custom Visualization

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!