Splunk Search

Creating time search butons in a view

dannux
Path Finder

Hi Everyone,

I have created a dynamic view that display data for the last 24 hours for a particular search. Is it possible to create a series of buttons that will allow me to modify the search timeline?

Ideally I want to modify the timespan by year, month, day, hour. In the same view

Thanks,
Dan

This is the code of my view:



sourcetype="pcs_servers" | timechart span="5m" avg(zCPU_IDLE) by source
-24h

line
time
right
PCS Servers Idle CPU





sourcetype="pcs_servers" | timechart span="5m" avg(free_memory) by source
-24h

column
time
right
PCS Servers Free MeM




dannux
Path Finder

After researching I was able to find the answer I used the following solution:


Last 24 hours
True


Hope it helps somebody else

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...