How to get a search in Splunk to show results from the last 24 hours and update in real-time every minute?

[stefanlasiewski]

I know that Splunk can show me results for the last 24 hours. I also know that Splunk can show me results in real time, with times like a "1 minute window".

I would like to see Splunk search results from the 24 hours, and also update these results in real time. This way, I can log into Splunk, bring up my dashboard and get a sense of what happened in the last day and show me what is going on from here on out.

[kml_uvce]

use earliest time as rt-24h in your dashboard

[stefanlasiewski]

This isn't showing me data from the previous 24 hours. This seems to show me data from now on forward, and refreshes every 24 hours. Or at least, that is what my test with Earliest: rt-30m Latest=rt or with a "30 minute window" does.

[acharlieh]

So a custom real time window of the past 24 hours? http://docs.splunk.com/Documentation/Splunk/6.2.1/Search/Selecttimerangestoapply#Define_custom_Real-...

[stefanlasiewski]

That's what I've been trying, but it's not updating in real time.