Changing Time Interval
Searches are always run within a search interval. You can change the time
interval of your search, choosing between static (the data does not
include live data) or make the query live (which means now). Whereas
historic (static) queries search on a specific window of time, in live
queries the time interval is relative to Now
, such as
Last 5m
or 1 day
.
The User Interface allows you to clearly distinguish between live mode and non-live mode when running a query, as you toggle between these two modes in separate ways: by enabling or disabling the Time Interval dialog box, respectively.
checkbox or by setting the desired time interval from theNote
The following specific behaviors exist when using the time interval selection:
Live mode is only available when using relative time ranges.
When you change the timetable from the Time dropdown, the liveness of the query is not impacted unless you enable the checkbox in order to run it as a live query instead, while the timeframe previously selected is kept.
When you disable the
checkbox, the query running will be stopped.The query on the Enter or click in the query editor to make it run again.
page also stops if you change to a relative or fixed time while it is running. Press
Figure 71. Data Time Interval
Click the arrow next to the Time dropdown field (top right corner) to set the desired time interval. In the appearing Time Interval dialog box, you can set:
Presets. Click it to select the desired relative time range — for example, or .
Relative time range. Select the time and time unit you want the search to start from — for example, start 8 hours ago. This can be live or static, meaning you can also enable the checkbox while keeping your time interval selection.
Fixed time range. To apply a fixed time range select the required Start and End dates and times from the calendar. Live mode is not available when you choose fixed time ranges.
Once selected, the selected time interval appears in the Time dropdown field.
Click Enter to start the query running.
in the query editor or pressTo make the query live, enable the
checkbox.
Tip
You can move the time interval to be earlier or later by clicking the Time dropdown field. You can make the interval of time larger (for example from 5 min to 10 min ago) by clicking the icon.
and buttons in the