Run an entire Search timewindowed

[hbrandt84]

Hi,

I have a scheduled search that detects assets when they enter and leave geofences.
For that I calculate things like total time travelled, distance, everage speed and so forth...

The search is pretty long and complicated and runs every 3 minutes and looks back 1 hour for changes.
The detected events are collected into a summary index.

Now comes the problem, that the logic for geofence-detection has changed - which means my summary index has become useless.
Ich made changes to my search according to customer requests and the current detected events are fine.
But everything up to this point has no value.

I made a plan to re-build the time from January 1st to today in a secondary summary index.
But i theory I would set the timewindow manually, as far as I understood.

means:
1. go to search app
2. copy my search into search window
3. set timerange to 01/01/20-00:00:00 --> 01/01/20-01:00:00
4. let the search run
5. set timerange to 01/01/20-00:03:00 --> 01/01/20-01:03:00
6. let the search run
...
1723434. set timerange to 02/27/20-15:00:00 --> 02/27/20-15:03:00
1723435. let the search run

Another way would be to make a JavaScript program in the backend of a Dashboard and let the search run in a loop that artificially sets the timerange.

Is there another way I am not seeing to let an entire search run in timeslots?
The obvious solution would be to re-write the entire search to be compatible with time-window based commands. But i dont see a way to make sure the results would 1:1 the same with changing the entire search.

[Richfez]

OK, I know you didn't want to show the search itself but I think we'll need to see it.

The thing is, you can probably do something with binning by _time in one hour chunks to get around your odd time limits. But we can't tell until we see the SPL (and possibly a few lines of the data).

Also, what exactly is the importance of 3 minutes and 1 hour? That seems arbitrary, and it feels like an answer that's super-specifically not really what's needed, only what's thought is needed. What actually are you trying to report on? If it's historical, why do you care if it's "reported on once every three minutes". It's also possible (not sure because we don't have the SPL) that you can just do this "continuously" and not worry about not paying attention for 2 minutes 59 seconds at a time. And make the search faster and easier also.

Anyway, happy splunking!

-Rich