Splunk Search

Creating time search butons in a view

dannux
Path Finder

Hi Everyone,

I have created a dynamic view that display data for the last 24 hours for a particular search. Is it possible to create a series of buttons that will allow me to modify the search timeline?

Ideally I want to modify the timespan by year, month, day, hour. In the same view

Thanks,
Dan

This is the code of my view:



sourcetype="pcs_servers" | timechart span="5m" avg(zCPU_IDLE) by source
-24h

line
time
right
PCS Servers Idle CPU





sourcetype="pcs_servers" | timechart span="5m" avg(free_memory) by source
-24h

column
time
right
PCS Servers Free MeM




dannux
Path Finder

After researching I was able to find the answer I used the following solution:


Last 24 hours
True


Hope it helps somebody else

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!