Splunk Search

Creating time search butons in a view

dannux
Path Finder

Hi Everyone,

I have created a dynamic view that display data for the last 24 hours for a particular search. Is it possible to create a series of buttons that will allow me to modify the search timeline?

Ideally I want to modify the timespan by year, month, day, hour. In the same view

Thanks,
Dan

This is the code of my view:



sourcetype="pcs_servers" | timechart span="5m" avg(zCPU_IDLE) by source
-24h

line
time
right
PCS Servers Idle CPU





sourcetype="pcs_servers" | timechart span="5m" avg(free_memory) by source
-24h

column
time
right
PCS Servers Free MeM




dannux
Path Finder

After researching I was able to find the answer I used the following solution:


Last 24 hours
True


Hope it helps somebody else

0 Karma
Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...