'Kibana KQL search saved with time range
I'm creating a saved search using Kibana Discover. On screen I can select the time range manually (default is "Last 15 minutes"). If I select "Last 24 hours" and Refresh the search, it works fine. However, when I save the search, the time range information is not saved. Whenever I open Kibana Discover and open my saved search, the time range is always the default (last 15 minutes).
I tried adding different conditions (below) to my KQL query, to no avail. :^(
and @timestamp >= "now-24h"
and @timestamp >= now-24h
and timestamp >= "now-24h"
and @timestamp >= "now-1d/d"
etc.
I also tried to "Add filter" using the @timestamp field. The only operators available are: is not, is one of, is not one of, is between, is not between, exists, does not exist.
So, I tried between now-24h and now. Yet, no results match the criteria.
However, if I manually change the time range to say, Last 30 days, then my filter works!
Question
How do I include the time range, say last 24 hours, in my KQL saved search so that it overrides the time range that is manually set on screen?
(Motivation: I don't want to change the default manual time range to be larger than the range used in all saved searches. Also, I want to make the saved searches available to a support team with minimal manual configuration.)
(I'm using Kibana v7.10.0.)
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|

