Dashboards & Visualizations

changing start, end times of searches on dashboard

tven7
Path Finder

I have 5 searches that are charted out and added to a Dashboard named ABC.

All the 5 searches the time i search back to is -20m to now.

Is there a way to update all the searches in the dashboard with something like say -120m to now if i decide that is what is relevant? Is that possible without having to add new charts with the new time values to the dashboard?

I should warn that i am new to splunk and maybe missing something obvious.

Tags (1)
1 Solution

Ron_Naken
Splunk Employee
Splunk Employee

You can modify your Dashboard by selecting the dashboard and clicking Actions-->Edit dashboard.... Edit the panels you want to change, and if the panel is using an in-line search, you can change the time range right there.

If a panel makes reference to a saved search, you will need to locate the specified search in Manager-->Searches and Reports to change the time range.

NOTE: If you don't see the saved search you're looking for in Manager-->Searches and Reports, be sure to double-check the App Context drop-down on the top-left of the page -- try setting it to All.

View solution in original post

msettipane
Splunk Employee
Splunk Employee

Depending on the data you are searching for you could also use the <searchPostProcess> tag which allows you to use a PostProcess search.

There are examples in the UI Example app that you can download off of Splunkbase.

This would allow you to conduct one search over that timeframe and let the other searches use its results.

Ron_Naken
Splunk Employee
Splunk Employee

You can modify your Dashboard by selecting the dashboard and clicking Actions-->Edit dashboard.... Edit the panels you want to change, and if the panel is using an in-line search, you can change the time range right there.

If a panel makes reference to a saved search, you will need to locate the specified search in Manager-->Searches and Reports to change the time range.

NOTE: If you don't see the saved search you're looking for in Manager-->Searches and Reports, be sure to double-check the App Context drop-down on the top-left of the page -- try setting it to All.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...