Changing Time Interval

The time range of the query is set in the UI. It is strongly recommended to limit the time range of queries as much as possible. This ensures, that LogScale is searching the relevant data to the information required, improving efficiency and reducing unnecessary data processing.

Data Time Interval

Figure 77. Data Time Interval


Elements of the time range controls:

  • The time zone picker allows you to set a temporary time zone for your search. This setting will influence how time ranges using calendar definitions - such as fixed time range and intervals like today or last month — calculate the query's start and end timestamps. For more information on setting the time zone, see Set Time Zone.

  • The Time Selector enables you to specify the time range for your query.

    • Use the navigation arrows (< and >) to move backward and forward through time intervals.

    • The magnifier allows you to quickly extend the time range by the same interval, making it easy to expand your search scope incrementally.

  • Live query checkbox. LogScale offers two modes for running queries: live and static.

    • Live queries are ideal for monitoring scenarios where you need to observe the data as it arrives.

      • These queries use a time interval relative to the current moment (for example, last 5 minutes, last 1 day).

      • When enabled, results will update as soon as new data becomes available.

      • Time intervals that use anchoring (for example: today, yesterday) are not supported in live queries.

    • Static queries are better suited for investigating past events.

      • All time interval definitions are supported in this mode.

Available time intervals:

  • Presets: quickly select from commonly used time intervals.

    • Use case: ideal for frequent searches, allowing you to select standard time ranges, like last 24 hours or last 7 days with a single click.

  • Relative Time Range allows more flexibility in selecting a relative time range

    • The Simple tab provides flexible adjustment of the start of the time interval, with the most common units like days, hours, minutes etc. The time interval is always relative to now.

Additional features of the Time Selector

  • Time intervals can be copied and pasted between search session using the Copy and Paste icons available from the Time Selector.

  • The time field selection controls which time field (@timestamp or @ingesttimestamp) is used when evaluating the time range for a query. By default, @timestamp is used. Use @ingesttimestamp when validating an Aggregate Alert query. See Select alert timestamp for more information.

Note

The following specific behaviors exist when using the time interval selection:

  • Live mode is only available when using relative time ranges.

  • When you change the timetable from the Time dropdown, the liveness of the query is not impacted unless you enable the Live checkbox in order to run it as a live query instead, while the timeframe previously selected is kept.

  • When you disable the Live checkbox, the query running will be stopped.

  • The query on the Search page also stops if you change to a relative or fixed time while it is running. Press Enter or click Run in the query editor to make it run again.

Tip

You can move the time interval to be earlier or later by clicking the < and > buttons in the Time dropdown field. You can make the interval of time larger (for example, from 5 min to 10 min ago) by clicking the Magnifier icon.