Dashboards & Visualizations

Time to search can only be set by the time range picker.

palisetty
Communicator

Time to search can only be set by the time range picker.

False is the answer. What are the other ways you can think of, please?

Tags (1)
0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

Time modifiers inline of the search like this

index=... earliest=-24h@h latest=now

View solution in original post

woodcock
Esteemed Legend

Also:

index= ... earliest=-x latest=now

And along with that, using TimePicker indirectly after-the-fact:

|dbxquery ...
|inputlookup append=t
| addinfo
| where _time>=info_min_time AND _time<=info_max_time

And lastly, you can interact with many visualizations (e.g. Line Chart) and click and/or drag and then select Zoom to selected and it will do that and update the TimePicker.

0 Karma

mydog8it
Builder

This one might not count, by clicking the event time and specifying a relative search window... which drives the time picker, which is why I said it might not count.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Time modifiers inline of the search like this

index=... earliest=-24h@h latest=now

palisetty
Communicator

-24h@h means? 24 hours yesterday is it? Please correct me

0 Karma

woodcock
Esteemed Legend

Now - 24hours, snapped down to the start of that hour.

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...