I created an accelerated search that is set for 7 days retention, runs every 30 minutes and searches 30 minutes back when it runs. I set it up in my dashboard to be used as a base search like so:
<search id="reportBase" ref="Accelerated report base">
<earliest>$set_time.earliest$</earliest>
<latest>$set_time.latest$</latest>
</search>
I then attempt to use it and modify the results with tokens like so:
<search base="reportBase">
<query>| search type IN ($types$) AND account IN ($accounts$) | stats count by hostname | sort -count </query>
The new search modifications with tokens works. However, no matter what I do, the time picker does not work. I only ever get back the last 30 minutes of data. I thought the 7 day retention meant I could get back any amount of time up to 7 days back quickly, not just the last 30 minutes.
I tried to work around this by running this but the same thing happens:
| loadjob savedsearch="MyUser:search:Accelerated report base"
Then, I tried to use it in normal search and the time picker there also does nothing. It still only shows the last 30 minutes of data.
Am I missing something or can I not use accelerated reporting with a time picker?
I may be fundamentally misunderstanding how accelerated searching works. I thought I'd need to access the report or its results somehow.
What I see in my searches that use the exact same stats command is that the Job setting says "Using summaries for search"
This was not explained in any of the accelerated report documentation.