Splunk Search

Creating time search butons in a view

dannux
Path Finder

Hi Everyone,

I have created a dynamic view that display data for the last 24 hours for a particular search. Is it possible to create a series of buttons that will allow me to modify the search timeline?

Ideally I want to modify the timespan by year, month, day, hour. In the same view

Thanks,
Dan

This is the code of my view:



sourcetype="pcs_servers" | timechart span="5m" avg(zCPU_IDLE) by source
-24h

line
time
right
PCS Servers Idle CPU





sourcetype="pcs_servers" | timechart span="5m" avg(free_memory) by source
-24h

column
time
right
PCS Servers Free MeM




dannux
Path Finder

After researching I was able to find the answer I used the following solution:


Last 24 hours
True


Hope it helps somebody else

0 Karma
Get Updates on the Splunk Community!

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...