Changing Time Interval

Searches are always run within a search interval. You can change the time interval of your search, choosing between static (the data does not include live data) or make the query live (which means now). Whereas historic (static) queries search on a specific window of time, in live queries the time interval is relative to Now, such as Last 5m or 1 day.

The User Interface allows you to clearly distinguish between live mode and non-live mode when running a query, as you toggle between these two modes in separate ways: by enabling or disabling the Live checkbox or by setting the desired time interval from the Time Interval dialog box, respectively.


The following specific behaviors exist when using the time interval selection:

  • Live mode is only available when using relative time ranges.

  • When you change the timetable from the Time dropdown, the liveness of the query is not impacted unless you enable the Live checkbox in order to run it as a live query instead, while the timeframe previously selected is kept.

  • When you disable the Live checkbox, the query running will be stopped.

  • The query on the Search page also stops if you change to a relative or fixed time while it is running. Press Enter or click Run in the query editor to make it run again.

Data Time Interval

Figure 75. Data Time Interval

  1. Click the arrow next to the Time dropdown field (top right corner) to set the desired time interval. In the appearing Time Interval dialog box, you can set:

    • Presets. Click it to select the desired relative time range — for example, 15 mins or 30 days.

    • Relative time range. Select the time and time unit you want the search to start from — for example, start 8 hours ago. This can be live or static, meaning you can also enable the Live checkbox while keeping your time interval selection.

    • Fixed time range. To apply a fixed time range select the required Start and End dates and times from the calendar. Live mode is not available when you choose fixed time ranges.

      Once selected, the selected time interval appears in the Time dropdown field.

  2. Click Run in the query editor or press Enter to start the query running.

  3. To make the query live, enable the Live checkbox.


You can move the time interval to be earlier or later by clicking the < and > buttons in the Time dropdown field. You can make the interval of time larger (for example from 5 min to 10 min ago) by clicking the Magnifier icon.