Page 1 of 1
Query for timestamp wildcard or from/to
Posted: Tue Mar 24, 2015 11:55 am
by markbe
Hello
I have a dashboard defined to show me only error messages. When I identified a log message to investigate more I'd like to see the full stack trace to it. Is there a best practice how to achieve this?
The approach I take seems quirky, query for the timestamp and disabling the error only filter. Unfortunately the timestamp query shows me only results from the exact same timestamp. Is there a way to use wildcards or from/to when query for a timestamp?
Thanks
Mark
Re: Query for timestamp wildcard or from/to
Posted: Tue Mar 24, 2015 3:40 pm
by jolson
Is there a way to use wildcards or from/to when query for a timestamp?
You can definitely use a from/to filter for timestamping. Please navigate to the 'Dashboard' screen - notice near the top where it says the time (mine says 'a day ago to a few seconds ago').
You can click here, and select 'Custom' to define your own time period. Please enter the times you would like to search in between here, and a filter will be generated for you.
Does that help answer your question?
Re: Query for timestamp wildcard or from/to
Posted: Wed Mar 25, 2015 2:16 pm
by markbe
Thank you, I missed that UI element on top. Always was looking in the filter area...
Re: Query for timestamp wildcard or from/to
Posted: Wed Mar 25, 2015 4:30 pm
by jolson
No worries! Is there anything else that I can help you with, or are we good to close?
Re: Query for timestamp wildcard or from/to
Posted: Wed Mar 25, 2015 4:34 pm
by markbe
This issue is solved, for other things coming up in our evaluation I'lll open new tickets if required to allow others finding an answer.
I would have marked your answer as "This resolved my question" or closed the post if I would have found a way to do it.
Re: Query for timestamp wildcard or from/to
Posted: Wed Mar 25, 2015 4:40 pm
by jolson
Sounds good to me. The protocol in the Nagios forums is to have our support team lock the thread after the issue has been resolved. I'll lock this thread, and if you have any further questions please feel free to begin new ones. Thanks, hope to see you again!