Time to search can only be set by the time range picker.
False is the answer. What are the other ways you can think of, please?
Time modifiers inline of the search like this
index=... earliest=-24h@h latest=now
Also:
index= ... earliest=-x latest=now
And along with that, using TimePicker
indirectly after-the-fact:
|dbxquery ...
|inputlookup append=t
| addinfo
| where _time>=info_min_time AND _time<=info_max_time
And lastly, you can interact with many visualizations (e.g. Line Chart
) and click and/or drag and then select Zoom to selected
and it will do that and update the TimePicker
.
This one might not count, by clicking the event time and specifying a relative search window... which drives the time picker, which is why I said it might not count.
Time modifiers inline of the search like this
index=... earliest=-24h@h latest=now
-24h@h means? 24 hours yesterday is it? Please correct me
Now - 24hours, snapped down to the start of that hour.