Splunk Enterprise Security

Splunk App for Enterprise Security 3.3.1: How to change the drilldown offset in a correlated search to last 10 minutes?

rroberts
Splunk Employee
Splunk Employee

I would like to change the drilldown offset in my correlated search to last 10 minutes. Ive tried 10m in first offset box, but not sure what to put in the second offset box. Looks like the "Save" button is validating these fields and putting a "0y" in the second box? Why 0y? Shouldn't I be able to use now? Also, I notice you can use seconds IE 30s. It will automatically be changed to m (minutes)? Is this a correct assumption?

0 Karma

aholzel
Communicator

I had the same problem with 3.3.0 so I used "earliest=xxx latest=xxx" in the Drill-down search to work around this.

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...