How to Schedule a Report for multiple Year-Month variables from a drop down list

[promukh]

Hello Experts,

I do have a search with multiple appends on a Dashboard Panel  , which is taking longer than usual to generate the results.

There is dropdown in the panel with Month-Year values generated , which is feeded into the search as variable when end-user selects one.

Drop Down Values are as shown below -  ( 3 Months Interval ) 

Jan 2021

Apr 2021

Jul 2021

Oct 2021

Jan 2022

The search is feeded with one of the values from the above as shown below  ..

|search ..| fields MonthYear,field1,field2,field3 | where MonthYear="$month$" | table field1,field2,field3.

Given the search is taking longer amount of time , we plan to schedule it through a report and run once a Day and store the results beforehand .

Will it be possible to schedule the report run with all the above mentioned "MonthYear" values ? how can we achieve the same ?

Any leads is appreciated  , Thanks

[promukh]

thanks @gcusello  , i will try the solution 

[gcusello · Accepted solution]

Hi @promukh,

you could schedule to run the report every three months saving results in a Summary index.

Then you can search on this index.

in other words, you have to:

create a summary index called e.g. "my_reports"

schedule a search like this every three months after the 1st of the month: 

Your_search earliest=-3mon@mon latest=@mon
| table _time my_fields
| collect index=my_reports

run a search like this:

index=my_reports
| table my_fields

 Ciao.

Giuseppe