Dashboards & Visualizations

Is there a visualization of the _time and alerts issues?

danielbb
Motivator

Is there a visualization of the _time and alerts issues, such as the one described at How to alert using _indextime for window instead of _time ?

I need to visually show it to the managers here.

Tags (2)
0 Karma

woodcock
Esteemed Legend

First, set your Timepicker on the Advanced tab and set Earliest to 0 and Latest to +Infinty (NOTE: DO NOT use All Time because in some versions of Splunk it uses now for Latest instead of +Infinity). Next use a search like this:

index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="AndSourcetypeToo" _index_earliest=-6m@m _index_latest=-5m ...

richgalloway
SplunkTrust
SplunkTrust

What "time and alerts issues" are you talking about?
What difficulty are you having modifying the search in the cited answer to suit your needs?

---
If this reply helps you, Karma would be appreciated.

danielbb
Motivator

The issue is described at the link - when to use _indextime in alerts in addition to _time. Is there a visualization that shows how they can be used in alerts?

0 Karma

niketn
Legend

@danielbb check out Timeline Custom Visualization

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...