Changing Time Interval
Searches are always run within a search interval. You can change the time
interval of your search, choosing between static (the data does not
include live data) or make the query live (which means now). Whereas
historic (static) queries search on a specific window of time, in live
queries the time interval is relative to Now, such as
Last 5m or 1 day.
The User Interface allows you to clearly distinguish between live mode and non-live mode when running a query, as you toggle between these two modes in separate ways: by enabling or disabling the checkbox or by setting the desired time interval from the Time Interval dialog box, respectively.
Note
The following specific behaviors exist when using the time interval selection:
Live mode is only available when using relative time ranges.
When you change the timetable from the Time dropdown, the liveness of the query is not impacted unless you enable the checkbox in order to run it as a live query instead, while the timeframe previously selected is kept.
When you disable the checkbox, the query running will be stopped.
The query on the page also stops if you change to a relative or fixed time while it is running. Press Enter or click in the query editor to make it run again.
 |
Figure 71. Data Time Interval
Click the arrow next to the Time dropdown field (top right corner) to set the desired time interval. In the appearing Time Interval dialog box, you can set:
Presets. Click it to select the desired relative time range — for example, or .
Relative time range. Select the time and time unit you want the search to start from — for example, start 8 hours ago. This can be live or static, meaning you can also enable the checkbox while keeping your time interval selection.
Fixed time range. To apply a fixed time range select the required Start and End dates and times from the calendar. Live mode is not available when you choose fixed time ranges.
Once selected, the selected time interval appears in the Time dropdown field.
Click in the query editor or press Enter to start the query running.
To make the query live, enable the checkbox.
Tip
You can move the time interval to be earlier or later by clicking the and buttons in the Time dropdown field. You can make the interval of time larger (for example from 5 min to 10 min ago) by clicking the icon.