I am using the following query to load firewall data into a summary index I've created:
host="aegis1.grc.nasa.gov" | sitop policy_id
This query runs every 5 minutes and it working well.
However, now, I want to be able to "backfill" data into this summary index, using past firewall data. How is this done? I tried scheduling the query from the beginning of the year, but I'm not sure if it worked.