Question

I’m building a view in splunk, and want to show a timechart. However, I would like to only show data for the last 24 hours, not the last week splunk defaults to. How do I do this?

When I’m just doing a search I can select the time span at the top of the page, but that isn’t available when creating a dashboard chart.

Answer 1

Actually ,in Simple XML, if you use a “form” element rather than a “dashboard” element , then you can use a time range picker.

<form>
 <label>My Lovely Splunk View</label>

<fieldset autoRun="true">

<input type="time" searchWhenChanged="true">
  <default>Last 60 minutes</default>  
</input>

</fieldset>

  <row>
    <chart>
      <searchName>My Search</searchName>
      <title>Cool Chart</title>
      <option name="charting.chart">line</option>
    </chart>
  </row>
</form>