Getting Data In

How to ensure data ingested into summary indexing through schedule reports is stored with the timestamp of the date the report is run?

uhkc777
Explorer

Hi,

I have a scheduled report which runs every midnight over last 30 days data and indexing into summary index.
But, in summary indexing that result from schedule report is storing with timestamp of 30 days back.
Eg: if i run the schedule report on 02/01 over last 30 days data,the result of this storing in summary index with 01/01 timestamp.

so while calling this summary indexing in my dashboards, i'm using: index=summary et=-30d@d

is there any way to store the summary indexing data with today time stamp?

Thanks,

0 Karma
1 Solution

somesoni2
Revered Legend

If your summary index search result contains field _time, it'll use that as the _time for summary index data. If it doesn't contain _time, then the search's earliest timestamp (which you're using as -30d@d) as _time for summary index result. So if you want to keep the current day (day on which the summary search was run, create a field _time with current day. like this.

index=test earliest=-30d@d |table _time,x|timechart span=1d dc(x) as count|stats avg(count) as Avg | eval _time=relative_time(now(),"@d")

View solution in original post

somesoni2
Revered Legend

If your summary index search result contains field _time, it'll use that as the _time for summary index data. If it doesn't contain _time, then the search's earliest timestamp (which you're using as -30d@d) as _time for summary index result. So if you want to keep the current day (day on which the summary search was run, create a field _time with current day. like this.

index=test earliest=-30d@d |table _time,x|timechart span=1d dc(x) as count|stats avg(count) as Avg | eval _time=relative_time(now(),"@d")

View solution in original post

rjthibod
Champion

Please share the savedsearch settings and the actual search that are populating your summary index.

0 Karma

uhkc777
Explorer

where can i find the saved search settings?.

search query:
index=test earliest=-30d@d |table _time,x|timechart span=1d dc(x) as count|stats avg(count) as Avg
I'm saving it as report .
These are the steps i'm following for summary indexing.

settings-->searches,Reports-->open this report-->schedule this report everyday midnight--->enable summary indexing-->select summary index

0 Karma

lguinn2
Legend

Also, we need to see the search that you are using to report out from your summary index.

0 Karma

uhkc777
Explorer

index=test|eval date=strftime(_time,"%Y-%m-%d")|table Date,x|chart dc(x) by Date|appendcols[|search index=summary earliest=-30d@d|head 1|table Avg]|filldown Avg

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!