Configure dashboard filters

Supported in:

Google secops SIEM

This document explains how you can apply filters to data source fields to refine the data displayed in applicable charts.

Add a filter

Note: You must have the chronicle.nativeDashboards.update IAM permission to add a filter.

To add a filter, do the following:

1. On the Edit Dashboard page, click Filter to add a filter.

2. On the Manage filters window, click Add to add a new filter.

3. In the Field to filter field, enter the field you want to use to filter the data. For more information about supported data sources and fields, see Supported data sources.

4. In the Filter name field, enter a name for the filter.

5. In the Apply to field, select the charts where the filter should be applied.

6. Optional: Set a default value for the filter.

7. Click Done to add the filter and close the Manage filters window.

Manage the global time filter

The global time filter applies to all charts, regardless of the chart's data source.

Note: You must have the chronicle.nativeDashboards.update IAM permission to add a global time filter.

To select the charts for which the global time filter can be applied, do the following:

1. On the Edit Dashboard page, click Filter to add a filter.

2. On the Manage filters window, select Global time filter from the filters list.

3. Click the toggle to ensure that the global time filter is enabled.

4. In the Apply to field, select the charts to apply the global time filter.

5. In the Set default values field, set a time range to view data, using either absolute or relative values..

6. Click Done to enable the filter and close the Manage Filters window.

Apply a dashboard filter

Note: You must have the chronicle.nativeDashboards.get IAM permission to apply a filter.

To apply a filter, do the following:

1. On the Edit Dashboard page, click Back > Filter to view the dashboard filters.

2. On the Dashboard filters window, select the filter you created.

3. Enter a value for the selected field.

4. Click Apply. The charts for which the filter is applicable are refreshed with new data.

Change the global time filter

When you open a dashboard, the global time filter is applied on the applicable charts with the default time range.

Note: You must have the chronicle.nativeDashboards.get IAM permission to apply the global time filter.

To change the global time filter value, do the following:

1. Click Schedule.

2. In the Global Time Filter dialog, select either the past or between operator.

3. Select the date range.

4. Click Apply. The selected charts update with new data based on the global time filter.

Understand the Past operator

The past operator calculates a start time based on the value and unit you provide. The end time is always the current moment.

The start time calculation depends on the unit:

• Seconds, Minutes, Hours: These units calculate the start time by subtracting the exact number of seconds, minutes, or hours from the current timestamp.
• Days, Weeks, Months, Years: These units snap the start time to the beginning of the current or previous period (for example, the start of the current day or month).

The following table shows examples based on a current timestamp of 13:13 on July 2, 2025:

Value	Unit	Filter start time
n	Seconds	13:13:00 July 2, 2025 minus n seconds
n	Minutes	13:13:00 July 2, 2025 minus n minutes
n	Hours	13:13:00 July 2, 2025 minus n hours
1	Day	00:00:00 July 2, 2025 (start of the current day)
2	Days	00:00:00 July 1, 2025 (start of the previous day)
1	Week	00:00:00 of the first day of the current week. The start day of the week depends on your system's locale settings.
1	Month	00:00:00 July 1, 2025 (start of the current month)
2	Months	00:00:00 June 1, 2025 (start of the previous month)
1	Year	00:00:00 January 1, 2025 (start of the current year)
2	Years	00:00:00 January 1, 2024 (start of the previous year)

Need more help? Get answers from Community members and Google SecOps professionals.