Our specific requirement is to have links to share with others, say while troubleshooting an issue, which can then be used even after weeks to come back to the same exact search result. So creating...
See more...
Our specific requirement is to have links to share with others, say while troubleshooting an issue, which can then be used even after weeks to come back to the same exact search result. So creating a report doesnt make sense in this case. To have something available weeks after is exactly what report is for. You don't want to force people to create their own bookmark for such purposes. And there is absolutely no need to instruct future users to enter them manually. (In fact, the best report is where you disallow time picker.) The point is, you CAN reproduce search results years after if your saved search contains the same time window as your original search. Have you read the document I linked? Say, I want people to search the following index=_internal
| timechart span=2h count by sourcetype
``` data emulation 2 ```
| addtotals
| delta "Total" as _delta
| foreach * Total
[eval <<FIELD>> = if(-_delta > Total, null(), '<<FIELD>>')] for the past 2 days, where "past 2 days" is merely a reference to my search time. You probably recognize that you don't need any precision in this time period. (I'll demonstrate more precise requirements later.) So, say I am searching at 1015 Zulu time of 2023-09-13. It is perhaps sufficient to pass 1000 Zulu time for future users. (Or 1100 as chances may suit.) I can save the search as index=_internal earliest=09/11/2023:10:00:00 latest=09/13/2023:10:00:00
| timechart span=2h count by sourcetype
``` data emulation 2 ```
| addtotals
| delta "Total" as _delta
| foreach * Total
[eval <<FIELD>> = if(-_delta > Total, null(), '<<FIELD>>')] If you want to be more precise, you can always specify time with more precision. You can do this by looking at your watch, or you can get it from Splunk. For example, I want index=_internal
| stats count by sourcetype for a certain period that I am searching for. I can do index=_internal
| stats count by sourcetype
| addinfo
| fields - info_s* This gives me sourcetype count info_max_time info_min_time dbx_health_metrics 8220 1694583382.000 1694579760.000 dbx_server 2 1694583382.000 1694579760.000 splunk_python 76 1694583382.000 1694579760.000 splunk_search_messages 2 1694583382.000 1694579760.000 splunk_web_access 5 1694583382.000 1694579760.000 splunk_web_service 15 1694583382.000 1694579760.000 splunkd 32275 1694583382.000 1694579760.000 splunkd_access 824 1694583382.000 1694579760.000 splunkd_ui_access 619 1694583382.000 1694579760.000 I just put info_min_time and info_max_time back. index=_internal earliest=1694579760.000 latest=1694583382.000
| stats count by sourcetype (They happen to be the past 4 hours.) As I said, if I want to know what happened in the past four hours tonight, this search will always give me the same output whether I do it tomorrow or a year after. And I never have to write a memo to myself about when I did this search, nor do I need to use time selector again.