This document explains how you can apply filters to data source fields to refine the data displayed in applicable charts.
Add a filter
To add a filter, do the following:
On the Edit Dashboard page, click filter_altFilter to add a filter.
On the Manage filters window, click addAdd to add a new filter.
In the Field to filter field, enter the field you want to use to filter
the data. For more information about supported data sources and fields,
see Supported data sources.
In the Filter name field, enter a name for the filter.
In the Apply to field, select the charts where the filter should be applied.
Optional: Set a default value for the filter.
Click Done to add the filter and close the Manage filters window.
Manage the global time filter
The global time filter applies to all charts, regardless of the chart's
data source.
To select the charts for which the global time filter can be applied, do the following:
On the Edit Dashboard page, click filter_altFilter to add a filter.
On the Manage filters window, select Global time filter from the filters list.
Click the toggle to ensure that the global time filter is enabled.
In the Apply to field, select the charts to apply the global time filter.
In the Set default values field, set a time range to view data, using
either absolute or relative values..
Click Done to enable the filter and close the Manage Filters window.
Apply a dashboard filter
To apply a filter, do the following:
On the Edit Dashboard page, click Back > filter_altFilter to view the dashboard filters.
On the Dashboard filters window, select the filter you created.
Enter a value for the selected field.
Click Apply. The charts for which the filter is applicable are refreshed with new data.
Change the global time filter
When you open a dashboard, the global time filter is applied on
the applicable charts with the default time range.
To change the global time filter value, do the following:
Click scheduleSchedule.
In the Global Time Filter dialog, select either the past or between operator.
Select the date range.
Click Apply. The selected charts update with new data based on the global time filter.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-29 UTC."],[[["\u003cp\u003eThis document details how to use native dashboard filters within Google SecOps to refine data in charts.\u003c/p\u003e\n"],["\u003cp\u003eYou can add filters by selecting a field, naming the filter, and choosing the charts to which it applies.\u003c/p\u003e\n"],["\u003cp\u003eA global time filter can be enabled and customized to apply a specific time range to selected charts.\u003c/p\u003e\n"],["\u003cp\u003eApplying a filter to a dashboard involves selecting it from the filter window and entering a value.\u003c/p\u003e\n"],["\u003cp\u003eChanging the global time filter can be achieved through the schedule interface, allowing selection of time ranges.\u003c/p\u003e\n"]]],[],null,["# Dashboard filters\n=================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n\nThis document explains how you can apply filters to data source fields to refine the data displayed in applicable charts.\n\nAdd a filter\n------------\n\n| **Note:** You must have the `chronicle.nativeDashboards.update` IAM permission to add a filter.\n\nTo add a filter, do the following:\n\n1. On the **Edit Dashboard** page, click filter_alt**Filter** to add a filter.\n\n2. On the **Manage filters** window, click add**Add** to add a new filter.\n\n3. In the **Field to filter** field, enter the field you want to use to filter\n the data. For more information about supported data sources and fields,\n see [Supported data sources](/chronicle/docs/reports/native-dashboards#data-sources).\n\n4. In the **Filter name** field, enter a name for the filter.\n\n5. In the **Apply to field**, select the charts where the filter should be applied.\n\n6. Optional: Set a default value for the filter.\n\n7. Click **Done** to add the filter and close the **Manage filters** window.\n\nManage the global time filter\n-----------------------------\n\nThe global time filter applies to all charts, regardless of the chart's\n[data source](/chronicle/docs/reports/native-dashboards#data-sources).\n| **Note:** You must have the `chronicle.nativeDashboards.update` IAM permission to add a global time filter.\n\nTo select the charts for which the global time filter can be applied, do the following:\n\n1. On the **Edit Dashboard** page, click filter_alt**Filter** to add a filter.\n\n2. On the **Manage filters** window, select **Global time filter** from the filters list.\n\n3. Click the toggle to ensure that the global time filter is enabled.\n\n4. In the **Apply to** field, select the charts to apply the global time filter.\n\n5. In the **Set default values** field, set a time range to view data, using\n either absolute or relative values..\n\n6. Click **Done** to enable the filter and close the **Manage Filters** window.\n\nApply a dashboard filter\n------------------------\n\n| **Note:** You must have the `chronicle.nativeDashboards.get` IAM permission to apply a filter.\n\nTo apply a filter, do the following:\n\n1. On the **Edit Dashboard** page, click **Back** \\\u003e filter_alt**Filter** to view the dashboard filters.\n\n2. On the **Dashboard filters** window, select the filter you created.\n\n3. Enter a value for the selected field.\n\n4. Click **Apply**. The charts for which the filter is applicable are refreshed with new data.\n\nChange the global time filter\n-----------------------------\n\nWhen you open a dashboard, the global time filter is applied on\nthe applicable charts with the default time range.\n| **Note:** You must have the `chronicle.nativeDashboards.get` IAM permission to apply the global time filter.\n\nTo change the global time filter value, do the following:\n\n1. Click schedule**Schedule**.\n\n2. In the **Global Time Filter** dialog, select either the `past` or `between` operator.\n\n3. Select the date range.\n\n4. Click **Apply**. The selected charts update with new data based on the global time filter.\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]