...r 4 days if I get the information. By discard it is because of the time it is taking, I don't know if I'm wrong but there is some configuration that limits a maximum timein seconds until it g...
Hello - I was reading this: https://docs.splunk.com/Documentation/SCS/current/Search/Timemodifiers But it is not very clear to me how to use the timemodifiers properly. in...
hi as you can see I use a base searchin order to dis play two single pnels, one on the last 24 h and one on the last 7 days so for the second panel I need to put the time range on the l...
I have a dropdown selection for a Policy field. I want to be able modify the searchtime based on the policy selected in the dropdown.
The drop down has 3 static options and depending on what i...
Hey everyone,
I've got a query here that I'm using to find values over 3 different periods of time. Today, yesterday and two days ago. I've made this query into a report and attached it to a d...
I have a saved search and I would like to limit the output to a specific timeframe- but unfortunately I am getting complete results and not the time range alone I want. | savedsearch test earliest=1...
...ow.
Is it possible to do this with only one "search" ?
Today i use 2 searchs which are the same instead the time-modifiers:
For the week-end view:
earliest_time = @w1-2d-6h
l...
I have a dashboard which uses tokens that look like this
earliest=$TIME.earliest$ latest=$TIME.earliest$+60s
If I use the timerange picker and select a relative time, the search works as e...
Hey guys.
I want to find hosts for all time which haven't any messages last 7 days, trying this:
index=main source=syslog | dedup host | table _time host | search latest=-7d
...oth in the same 12 hour time frame. " < 26-Mar-2021 12:59:56 o ' clock AM MDT > < Error >......" I am trying to run a search based on a dashboard panel that is using the m...