With the timeframe, you can define the period from which your data is being queried. If you don't specify the timeframe, the default -2h
is applied, meaning that the data being fetched is from the last two hours.
There are several ways to define the timeframe for your queries.
You can define a custom timeframe in the DQL queries: in the query input, use the fetch
command with the timeframe
or from
and to
parameter to override your manual settings from the timeframe selector.
You can define an ad-hoc timeframe, use an existing timeframe, or create a custom timeframe in the timeframe selection section next to the Run button.
The timeframe selection is disabled when you define the timeframe in the DQL query.
You can create a custom timeframe from a selection in the results.
Select multiple values from a field of timestamp
type (use the shift key to select multiple values).
Right-click and select Add to custom timeframes.
This selects the min()
and max()
values from the selected range and creates a new custom timeframe for your case.
You can define a custom timeframe in the query summary shown below the query input after you execute a query.
To speed up investigations, you can keep track of the time between events you're analyzing and the time when an incident occurred by adding the time perspective to your queries.
A virtual column with the timestamp offset is added to the nodes in the query tree. The offset displays the time difference between the reference time created and the timestamp of the event in the results table in the specific record.
Once you create a reference time, you can