Investigate: Set the Time Range for an Investigation

Document created by RSA Information Design and Development on Sep 18, 2017Last modified by RSA Information Design and Development on Oct 24, 2017
Version 8Show Document
  • View in full screen mode
 

When conducting an investigation in the Investigate > Navigate view, the time range options limit the results returned. You can select:

  • A time range relative to the collection. Ranges relative to the collection are based on the last collection time for data.
  • A time range relative to the calendar.
  • A custom date range.
  • All data.

The selected Date Range (type) is shown in the Navigate view tool bar as the Time Range label; by default the label is Last 3 Hours. The Time Range display shows the first and last timestamp for the date range being used for the metadata.

Note:  Time range is based on the Time Zone configured in the Profile Preferences panel as described in "Setting User Preferences" in the RSA NetWitness Suite Getting Started Guide.

Select a Built-In Time Range for the Investigation

  1. Click the Time Range option in the Navigate view toolbar. The default time range is for the Last 3 Hours, but a different value from the selection list, for example, All Data or Last Hour, may already be selected and used as the label in the options panel.
    The Time Range selection list is displayed.
    Time Range Selection List
  2. Do one of the following:
    • If you want to see all data, select All Data.
    • If you want to set a time range in minutes, hours, or days that is relative to the collection, select a value such as Last 10 minutes, Last 3 Hours, or Last 5 days.
    • If you want to set a time range relative to today, select Yesterday, All Day, or a part of the day such as Early Morning, Morning, Afternoon, or Evening.
    • If you want to set a unique date range, select Custom in the Time Range menu and follow the procedure below.
      The selected time range is applied to the current results in the Values panel.

Specify a Custom Time Range for an Investigation

  1. Select Custom in the Time Range menu.
    Date selection options are displayed in the toolbar.
    Custom Time Range
  2. Within the time Start Date and End Date fields, do the following to specify the date and time:
    1. Click a date from the calendar.
    2. (Optional) Select the time from the Hour, Minute, Second fields or click Now. The time selection defaults to the current time of day.

Note: If you specify custom start or end times in seconds, the value for start time in seconds always defaults to :00, and the value for end time in seconds always defaults to :59. For example, if you are using time to drill down into an issue, the drill time is interpreted as "HH:MM:00 - HH:MM:59." Seconds display in this format in Investigation > Navigate functions.

  1. To apply the range, click Go.
    The selected time range is applied to the current results in the Values panel.
You are here
Table of Contents > Conducting an Investigation > Refining Results Displayed in the Navigate View > Set the Time Range for an Investigation

Attachments

    Outcomes