Dashboard TimeFrame Filter

So you only want to show results from August, for example, correct?

Relative 1 month should work. Applied that to my query, then sorted by create_date to go back to the oldest and I do not have anything before 8/1.

I’ve tried for 1 week search couple of days back and it returned 29th and 30th July results as well.

Do you know what day that was used? One week should be Sunday to Saturday. If you can replicate and have screenshots, please share, but may need a support case.

Hi ​@gopinath_n,

We’ve got a feature request raised for this - this was something possible in the legacy SIEM dashboarding (looker embedded) without needing to filter this within the search logic.

There is a way around this (and you can get quite nifty with it to solve a lot of other time filtering requirements). The below example should do the job though for this requirement!

metadata.log_type = "OKTA"

timestamp.get_timestamp(metadata.event_timestamp.seconds, "MONTH", "GMT") = timestamp.get_timestamp(timestamp.current_seconds(), "MONTH", "GMT")

match:
    metadata.id

Kind Regards,

Ayman

Thanks ​@AymanC