Expanding the Time Frame
Searches are always run within a search interval. You can change the
timeframe of your search, choosing between static (the data does not
include live data) or make the query live (which means now). Whereas
historic queries search on a specific window of time, in live queries the
time interval is relative to
Now, such as
The User Interface allows you to clearly distinguish between live and non-live mode when running a query, as you toggle between these two modes in separate ways: by checking/unchecking the Live checkbox or by setting the desired timeframe from the Time Interval dialog, respectively.
Figure 88. Data Time Frame
Click the Time Selector on top — in the Time Interval dialog popping up you can set:
Presets. Click it to choose the desired relative time range — for example, or .
Relative Time Range. Select the time and time unit you want the search to start from — for example, start 8 hours ago. This can be live or static, meaning you can also check the Live checkbox while keeping your timeframe selection.
Fixed Time Range. To apply a fixed time range select the required Start and End dates and times from the calendar. Live mode is not available when you choose fixed time ranges.
Click Run or hit Enter in the query input field to start the query running.
Once selected, the chosen timeframe will appear in the Time Selector field.
To make the query live, click the Live checkbox.
You can move the time interval earlier or later by clicking the Time Selector field. You can make the interval of time larger e.g., from 5 min to 10 min ago by clicking the magnifier icon.and buttons in the
The following specific behaviours exist when using the time frame selection:
Live mode is only available when using relative time ranges.
When you change the timetable from the Time Selector, the liveness of the query is not impacted unless you check the Live checkbox in order to run it as a live query instead, while the timeframe previously selected is kept.
When you toggle off the Live checkbox, the query running will be stopped.
The query on the Search page also stops if you change to a relative or fixed time while it is running. Press Enter or click Run to make it run again.