Splunk Search

Run single search multiple times with different timeframes

p_basanth
New Member

I have a saved search named "myquery1". I want run this search 3 times (-60m@m, -4h@h and -12h@h).
The above outputs will be displayed in 3 panels of my dashboard
Errors in past 1 hour
Errors in past 4 hours
Errors in past 12 hours.
How can i create 1 search and specify time window in the panel?

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could run one search -12h@m and use three PostProcess modules to fix each timerange.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...