Hi everyone,
I am trying to accelerating one savedsearch "index=main |stats count by type,severity". Now I want an accelerated summary of "All time" data for the first time only and later, every 10minutes I want to collect an incremental summary of the last 10minutes data on top of the "All time" accelerated summary. Is there any way to achieve this?
Note: I've come across to know the auto_summarize.dispatch.earliest_time parameter which seems directly bound to "Summary range". If I keep earliest_time to -10min(Because auto_summarize.cron_schedule parameter is set to */10 * * * *) then my summary range is also changing from "Alltime" to "1 Day".
