Saved Searches with different time output

[appmandan]

I have a panel that's running 9 inline searches. Panel one displays a line chart of results for the last 24 hours, Panel 2 displays results for the last 7 days, and panel 3 displays the results for the last 30 days. I could reduce the 9 inline searches down to three using a safe search, but I'm having trouble figuring out how to specify the differnt time ranges in my different charts. Is there a way I can display results for one saved search in differnt panels that display a different time range?

Thanks

[lguinn2 · Accepted solution]

You should download the Splunk UI Examples for 4.1+ app. It's free and it has examples of

• running a single search (like a 30 day search) and then post-processing it into different dashboard panels (one for 24-hours, one for 7 days, etc.)
• putting a time pull-down on a dashboard panel, to let the user select the timerange they want to see

Post-processing is even better than a saved search - because it means that the search will only be run once and then the results can be manipulated for each dashboard panel. You can also use it when you want to have the same data displayed as a chart in one panel and as a top 10 list in another panel, for example.

There isn't any way to save your search with a variable selection of time ranges. The closest that you could come is to save your search as a macro. Use earliest=$X$ clause in the search to set the time range. X will be your substitution parameter in the macro. App developers seem to use a similar technique a lot.

[appmandan]

THANKS!!!!