I am trying to create a dashboard where one of the visuals is a sum total of values by Month. But the rest of them just show Last 30 days of data. How can I create a visual which would be such that the global time range on the top right wont affect that one particular view. Is this doable?
Hi adwaitjoshi,
This is not currently supported as all the requests for a dashboard visualizations must have the same Time Filter applied.
Cheers.
It is not possible. However, you could hack your way around it, maybe?
- Create an index pattern that does not use any timestamp field.
- Create a visualization that you desire using this index and add it to the dashboard.
- Voila?
Haven't tested this, but seems about right.
@sebastien Thoughts?
1 Like
Thanks Sebastien.
@NerdSec To what I understood @adwaitjoshi needs to display both visualisation with time series.
I cant create two indexes. The issue is I have more than 1 billion transactions in the index. By creating a second one, I would be replicating just for the sake of one visualization. May be a simple "do not use date filter" on a visualization may do it. Something that a lot of people can use I guess.
I am not sure I understand well your use case. You would like to disable the time filter on a time series visualisation?
Not really. The user sees a visual of last 90 days. The lowest chart of it is a month over month but it's for the year rather than just 90 dayd.
Have you tried to create a new index pattern and then for the Time Filter field name select "I don't want to use the time filter" ? And then use that pattern for the visualisation.
lets say my index is named "timeddata" the moment I type "timeddata*" it says there is already an index pattern and I cannot create a new one. I cannot simply replicate 1+ billion transactions.
@adwaitjoshi The only way is see you can achieve this is by a creating a new index pattern.
Maybe create a pattern timeddat*? Or maybe try naming indices as follows in future timeddata-00001 using rollover or daily indices. Helps a lot.
Like @NerdSec said, you can create a new index pattern with a wildcard timeddat*. Be aware that it will also read from any other indices starting with those chars (e.g. timeddata2)
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.