For the dashboard filter, is there way we can filter results for the current month?
in absolute and relative setting, not able to achieve that.
Solved
Dashboard TimeFrame Filter
Best answer by AymanC
Hi
We’ve got a feature request raised for this - this was something possible in the legacy SIEM dashboarding (looker embedded) without needing to filter this within the search logic.
There is a way around this (and you can get quite nifty with it to solve a lot of other time filtering requirements). The below example should do the job though for this requirement!
metadata.log_type = "OKTA"
timestamp.get_timestamp(metadata.event_timestamp.seconds, "MONTH", "GMT") = timestamp.get_timestamp(timestamp.current_seconds(), "MONTH", "GMT")
match:
metadata.id
Kind Regards,
Ayman
+17So you only want to show results from August, for example, correct?
Relative 1 month should work. Applied that to my query, then sorted by create_date to go back to the oldest and I do not have anything before 8/1.
I’ve tried for 1 week search couple of days back and it returned 29th and 30th July results as well.
+17Do you know what day that was used? One week should be Sunday to Saturday. If you can replicate and have screenshots, please share, but may need a support case.
+14- Bronze 5
- Answer
Hi
We’ve got a feature request raised for this - this was something possible in the legacy SIEM dashboarding (looker embedded) without needing to filter this within the search logic.
There is a way around this (and you can get quite nifty with it to solve a lot of other time filtering requirements). The below example should do the job though for this requirement!
metadata.log_type = "OKTA"
timestamp.get_timestamp(metadata.event_timestamp.seconds, "MONTH", "GMT") = timestamp.get_timestamp(timestamp.current_seconds(), "MONTH", "GMT")
match:
metadata.id
Kind Regards,
Ayman
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.