Hi,
I have a dashboard that reflects subscriber counts. It works just fine except for one little detail. This report is sent out on a weekly basis every Sunday at 2:00 am Central time. The dashboard currently updates every five minutes with new data. Is there a way I can create a dashboard that keeps the data static from the Sunday at 2:00 am and only updates the data the next Sunday at 2:00 am?
try to provide the time range - earliest and latest.
edit your dashboard - edit search - enter your search
edit your dashboard - edit search - Time Range Scope - Explicit Selection - Advanced -> -1w@w to @w+2h@h
meaning you can define time range of your search & reporting based on the earliest and latest.
try to provide the time range - earliest and latest.
edit your dashboard - edit search - enter your search
edit your dashboard - edit search - Time Range Scope - Explicit Selection - Advanced -> -1w@w to @w+2h@h
meaning you can define time range of your search & reporting based on the earliest and latest.
I think we are close on this one. A follow on question is even if I put earliest=@w+2h@h doesn't the dashboard continue to update during the week?
Meaning if a subscriber count is 3000 at sunday at 2am that count needs to stay the same until the next sunday at 2 am when it will then increase or decrease by the week's numbers
Would something like this work?
earliest=@w+2h@h latest=@w+2h@h+10m
have your dashboard search(es) reference the saved search rather than an inline.
Hi Bmacias84,
Sorry I'm not quite getting the concept.
The current search looks like this. Which works but I need to be able to recreate the report from Sunday at 2:00am and that doesn't work with this search.
earliest=-24h index=mso_statistics sourcetype=ic_connectivity_5min-too_small stat_name=subscribers |eval mso = upper(substr(mso,1,1)).lower(substr(mso,2)) |chart max(stat_val) as "Subscribers" by mso|addcoltotals labelfield=mso label=Total|eval Subscribers=tostring(Subscribers,"commas")|rename mso as "MSO - Click for Expanded View"