Splunk Enterprise Security

Splunk App for Enterprise Security 3.3.1: How to change the drilldown offset in a correlated search to last 10 minutes?

rroberts
Splunk Employee
Splunk Employee

I would like to change the drilldown offset in my correlated search to last 10 minutes. Ive tried 10m in first offset box, but not sure what to put in the second offset box. Looks like the "Save" button is validating these fields and putting a "0y" in the second box? Why 0y? Shouldn't I be able to use now? Also, I notice you can use seconds IE 30s. It will automatically be changed to m (minutes)? Is this a correct assumption?

0 Karma

aholzel
Communicator

I had the same problem with 3.3.0 so I used "earliest=xxx latest=xxx" in the Drill-down search to work around this.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...