When conducting an investigation in the Investigation > Navigate view, the time range options limit the results returned. You can select:
A time range relative to the collection. Ranges relative to the collection are based on the last collection time for data.
A time range relative to the calendar.
A custom date range.
The selected Date Range (type) is shown in the options panel as the Time Range label; by default the label is Last 3 Hours. The Time Range display shows the first and last timestamp for the date range being used for the Meta Data.
Note: Time range is based on the Time Zone configured in the Profile Preferences panel as described in "Configure User Preferences" in the Security Analytics Getting Started Guide.
Select a Built-In Time Range for the Investigation
In the options panel, click the Time Range option in the Navigate view toolbar. The default time range is for the Last 3 Hours, but a different value from the selection list, for example, All Data or Last Hour, may already be selected and used as the label in the options panel.) The Time Range selection list is displayed.
Do one of the following:
If you want to see all data, select All Data.
If you want to set a time range in minutes, hours, or days that is relative to the collection, select a value such as Last 10 minutes, Last 3 Hours, or Last 5 days.
If you want to set a time range relative to today, select Yesterday, All Day, or a part of the day such as Early Morning, Morning, Afternoon, or Evening.
If you want to set a unique date range, select Custom in the Time Range menu and follow the procedure below. The selected time range is applied to the current results in the Values panel.
Specify a Custom Time Range for an Investigation
Select Custom in the Time Range menu. Date selection options are displayed in the toolbar.
Within the time Start Date and End Date fields, do the following to specify the date and time:
Click a date from the calendar.
(Optional) Select the time from the Hour, Minute, Second fields or click Now.The time selection defaults to the current time of day.
Note: If you specify custom start or end times in seconds, the value for start time in seconds always defaults to :00, and the value for end time in seconds always defaults to :59. For example, if you are using time to drill down into an issue, the drill time is interpreted as "HH:MM:00 - HH:MM:59." Seconds display in this format in Investigation > Navigate functions.
To apply the range, click Go. The selected time range is applied to the current results in the Values panel.