Hi guys,
Is it possible to create several searches on data, differing in time range, and then display them in one dashboard panel?
We collect a huge amount of logs in splunk and looking at 3 or 5 days old data takes enormous amount of time. I was thinking of creating saved searches on hourly base for the past 10 days and concatenate the results so I get one panel with last 3 days, another with the last 5 days and one for the last 10 days. That way I will only need to add one day to the combined result , and drop the oldest. Is that possible? If so, any tips on where to look?
I searched the questions here and the internet but couldn't find a clue. I am quite new in splunk, so maybe I am asking something stupid. Splunk Version is 7.0.8.7.
