![]() This is weird, because, why wouldn't I be able to do a time-based filter on the savedsearch's result set to limit the data I want to see, while I can do filter on fields? Doesn't make sense to me. A relative time range is dependent on when the search. Time modifiers and the Time Range Picker. An absolute time range uses specific dates and times, for example, from 12 A.M. your base search eval Failover Timesubstr (Failover Time,0,10)stats. This happens for any timerange I want to use as filter on the results of the savedsearch original timerange. When searching or saving a search, you can specify absolute and relative time ranges using the following time modifiers: earliest latest.I'd get the following error: Error in 'SearchOperator:loadjob': Cannot find artifacts within the search time range for savedsearch_ident '::'. I can't reduce the timerange to and for example. | eval date_time_epoch = strptime(date_time,"%Y-%m-%dT%H:%M:%S.I've been experiencing this for a while with saved searches and it looks like that once a saved search is done and you want to show the results in a dashboard, you cannot query another timerange over it.įor example, a saved search has and and I'd like to use that saved search in a chart by using loadjob. You can change the dates at the panel level and test. That is wrong again.I have created a simplistic dashboard. Is there any chance you could look at this please and let me know where I've gone wrong. In Splunk, there are few types of searches available to populate search result or visualization as a form of dashboards those are, 1. The data is now being returned, so thank you for this, but it is not filtering the data to match the timepicker. | eval earliest = $toEarliest$ | eval latest = if($toLatest$ < 0,now(),$toLatest$) | where Epoch_STime >=earliest AND Epoch_ETime <=latest | eval earliest = $toEarliest$ | eval latest = if($toLatest$ < 0,now(),$toLatest$) | where Epoch_STime >= earliest AND Epoch_ETime <= latestI've been working through this, but I can't get the 'timepicker' to load the data.Ĭould you possible have a look at my XML below please and let me know where I've gone wrong? ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |