Splunk Search

How to display several time ranged search results in one dashboard panel?

eriketro
Engager

Hi guys,
Is it possible to create several searches on data, differing in time range, and then display them in one dashboard panel?

We collect a huge amount of logs in splunk and looking at 3 or 5 days old data takes enormous amount of time. I was thinking of creating saved searches on hourly base for the past 10 days and concatenate the results so I get one panel with last 3 days, another with the last 5 days and one for the last 10 days. That way I will only need to add one day to the combined result , and drop the oldest. Is that possible? If so, any tips on where to look?

I searched the questions here and the internet but couldn't find a clue. I am quite new in splunk, so maybe I am asking something stupid. Splunk Version is 7.0.8.7.

Tags (2)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...