Changing Time Frame

Searches are always run within a search interval. You can change the timeframe of your search, choosing between static (the data does not include live data) or make the query live (which means now). Whereas historic queries search on a specific window of time, in live queries the time interval is relative to Now, such as Last 5m or 1 day.

The User Interface allows you to clearly distinguish between live and non-live mode when running a query, as you toggle between these two modes in separate ways: by checking/unchecking the Live checkbox or by setting the desired timeframe from the Time Interval dialog, respectively.

Data Time Frame

Figure 69. Data Time Frame

  1. Click the Time Selector on top — in the Time Interval dialog popping up you can set:

    • Presets. Click it to choose the desired relative time range — for example, 15 mins or 30 days.

    • Relative Time Range. Select the time and time unit you want the search to start from — for example, start 8 hours ago. This can be live or static, meaning you can also check the Live checkbox while keeping your timeframe selection.

    • Fixed Time Range. To apply a fixed time range select the required Start and End dates and times from the calendar. Live mode is not available when you choose fixed time ranges.

  2. Click Run or hit Enter in the query input field to start the query running.

    Once selected, the chosen timeframe will appear in the Time Selector field.

  3. To make the query live, click the Live checkbox.


You can move the time interval earlier or later by clicking the < and > buttons in the Time Selector field. You can make the interval of time larger e.g., from 5 min to 10 min ago by clicking the magnifier icon.

The following specific behaviors exist when using the time frame selection:

  • Live mode is only available when using relative time ranges.

  • When you change the timetable from the Time Selector, the liveness of the query is not impacted unless you check the Live checkbox in order to run it as a live query instead, while the timeframe previously selected is kept.

  • When you toggle off the Live checkbox, the query running will be stopped.

  • The query on the Search page also stops if you change to a relative or fixed time while it is running. Press Enter or click Run to make it run again.