topic Re: How to ensure data ingested into summary indexing through schedule reports is stored with the timestamp of the date the report is run? in Getting Data In

How to ensure data ingested into summary indexing through schedule reports is stored with the timestamp of the date the report is run?

uhkc777 — Thu, 02 Feb 2017 15:20:23 GMT

Hi,

I have a scheduled report which runs every midnight over last 30 days data and indexing into summary index.
But, in summary indexing that result from schedule report is storing with timestamp of 30 days back.
Eg: if i run the schedule report on 02/01 over last 30 days data,the result of this storing in summary index with 01/01 timestamp.

so while calling this summary indexing in my dashboards, i'm using: index=summary et=-30d@d

is there any way to store the summary indexing data with today time stamp?

Thanks,

Re: How to ensure data ingested into summary indexing through schedule reports is stored with the timestamp of the date the report is run?

rjthibod — Thu, 02 Feb 2017 17:07:49 GMT

Please share the savedsearch settings and the actual search that are populating your summary index.

Re: How to ensure data ingested into summary indexing through schedule reports is stored with the timestamp of the date the report is run?

lguinn2 — Thu, 02 Feb 2017 17:11:35 GMT

Also, we need to see the search that you are using to report out from your summary index.

Re: How to ensure data ingested into summary indexing through schedule reports is stored with the timestamp of the date the report is run?

uhkc777 — Thu, 02 Feb 2017 17:15:36 GMT

where can i find the saved search settings?.

search query:
index=test earliest=-30d@d |table _time,x|timechart span=1d dc(x) as count|stats avg(count) as Avg
I'm saving it as report .
These are the steps i'm following for summary indexing.

settings-->searches,Reports-->open this report-->schedule this report everyday midnight--->enable summary indexing-->select summary index

Re: How to ensure data ingested into summary indexing through schedule reports is stored with the timestamp of the date the report is run?

uhkc777 — Thu, 02 Feb 2017 17:23:08 GMT

Re: How to ensure data ingested into summary indexing through schedule reports is stored with the timestamp of the date the report is run?

somesoni2 — Thu, 02 Feb 2017 21:53:29 GMT

If your summary index search result contains field _time, it'll use that as the _time for summary index data. If it doesn't contain _time, then the search's earliest timestamp (which you're using as -30d@d) as _time for summary index result. So if you want to keep the current day (day on which the summary search was run, create a field _time with current day. like this.

index=test earliest=-30d@d |table _time,x|timechart span=1d dc(x) as count|stats avg(count) as Avg | eval _time=relative_time(now(),"@d")