Set time ranges for your dashboard queries

This topic describes how to select time ranges for dashboard queries.

You must select a Time and a Compare to time in order to view your data. Ingest monitoring compares the time defined in the Time field with the same time window for the day defined in the Compare to window to help you find trends and patterns in your data. The Time field lets you select a time range that ends with the current time, allowing for a brief lag based on saved searches. This time lag is always 10 minutes unless there are any failed saved searches.

You can view your entities in the Ingestion metrics dashboard to view the exact time for which data is returned.

Table 1. Time ranges
Field nameDescriptionExampleField values
TimeSelect the current time range that ends with the current time. There is a time lag which is always 10 minutes unless there are any failed saved searches. You can view your entities in the Ingestion metrics dashboard to view the exact time for which data is returnedFor example, if it is 1 PM and you select "Last 60 minutes", then the Ingest monitoring dashboard will display data from approximately 11:50 am to 12:50 PM that day.
  • Last 15 minutes
  • Last 30 minutes
  • Last 60 minutes
  • Last 24 hours
  • Last 7 days
Compare toSelect the past time frames that you want to compare to the selected Time value. There is a time lag, which is always 10 minutes unless there are any failed saved searches. You can view your entities in the Ingestion metrics dashboard to view the exact time that data is returned. For example, if you select "1 day ago" then the dashboard collects data from approximately 11:50 am to 12:50 PM from the previous day for comparison.
  • None: When selected, Ingest monitoring will not compare data and no comparison metrics will be returned in your search summary.
  • 1 day ago: Compares the data for the time defined in the Time field to data ingested at the same time one day ago.
  • 7 days ago: Compares the data for the time defined in the Time field to data ingested at the same time seven days ago.