Splunk Search

Setting Custom/Default Time in Splunk Search/Dashboard

eraasch
New Member

As the title suggests I am attempting to set a custom and default for a splunk dashboard that I created. When it opens I need it to snap to the previous weekday between 16:26 and 16:42 CST. Does anyone know how I would go about doing this?

Labels (1)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Use default earliest=-w@w+1d and default latest=@w5+1d

(Use advanced section if you are selecting from timerange picker UI.)

VatsalJagani_0-1640507460750.png

Then use this filter in the SPL search query

where date_hour=16 AND date_minute>=26 AND date_minute<=42
0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...