How to conditionally set the index for a search based on the selected timerange?

[lyndac]

I have a datasource that indexes approximately 100,000 events per hour. The dashboards that the user would like, will show stats of the data over pretty much any timeframe (last hour, last 24 hours, last 7 days, last 3 months, etc). For any timerange longer than 24 hours, the search is just too slow. Enter summary indexing! To ensure that all the events end up in the summary index, I have to set up the saved search to execute every hour and summarize the events from -3h@h to -2h@h (otherwise some late data gets missed).

So, in my dashboards (which I use Sideview Utils to create), I'd like to use the summary index for any timerange > 24 hours, but use the original index for any timerange less than 24 hours so that the user can see the most events possible.

How can I set the index based on the selected timerange? Is this even possible?

[sideview · Accepted solution]

Sure.

1) I should say that IF Javascript is your cup of tea, you could do this easily with a Sideview CustomBehavior. Implement getModifiedContext and it's less than 10 lines of code to do what you need here and produce some $indexToUse$ token.

However... most Sideview Utils users I think avoid that particular cup of tea so let us move on.

2) More Fun! Use a little dummy search, aka a "stats count" search, along with a ResultsValueSetter. to do our dirty work.

Specifically, take this weird little combo here, nest it downstream from your TimeRangePicker, (or more generally from whatever is setting your timerange)

<module name="Search">
  <param name="search"><![CDATA[
    | stats count | addinfo | rename info_min_time as earliest | eval hoursago=(now()-earliest)/3600 | eval indexToUse=if(hoursago>24,"summary","main")
  ]]></param>
  <module name="ResultsValueSetter">
    <param name="fields">indexToUse</param>
    ...

We make a weird little field up in our dummy search's search results, called "indexToUse" whose value is either "summary" or "main". And then we use ResultsValueSetter to grab this field, pull it down and make it into a $foo$ token in the UI.

net result -- downstream from that ResultsValueSetter module, you can use $indexToUse$ in your search or in any Sideview module and it will be either "summary" or "main" depending on the length of the user's timerange.

3) In theory you could use a Sideview ValueSetter module, although in the case of timerange tokens, a bug has just days ago come to light that ValueSetter does not treat the timerange tokens as you would expect so that would fight you here. At least as of this writing I would not go that particular way (it'll be fixed though in an upcoming release).