Hi~there
Does anyone know if real-time search on dashboard can display last accumulated results such as last -1h when entering the view(for graph or resulting table), because i found every time i enter the dashboard, it run the search from that time. That is to say it accumulate from zero result(like non-schedule saved search). we use vesion 4.1.8
Thanks in advance.
No, not currently possible, though there are workarounds that you can try. See the answers to this question: http://splunk-base.splunk.com/answers/24641/populate-initial-realtime-chart-with-historical-data
No, not currently possible, though there are workarounds that you can try. See the answers to this question: http://splunk-base.splunk.com/answers/24641/populate-initial-realtime-chart-with-historical-data
I got it, thanks