schedule search settings for time range

[shaganga]

Hi

we have created saved search with schedule type (cron every 2 mins) and time range (-2 mins earlier to now) with enabled the summary index which is working perfect.

Can we schedule saved search in below manner?
instead of picking time range -2mins, Can we apply the incremental time range (where if its not indexed, it can be picked up and stored in summary index)?

[cpetterborg]

You can't say "pick up where you left off," unfortunately.

What you probably want to do is not use now for the end time. If the search gets delayed it will pick up events past the end of the minute that it was supposed to end on, and you may miss some events that would have been at the beginning of the minutes that the search started. Use @m in place of now and you will get the search to stop at the minute boundary, and use -2m@m for your start time. These will always hit the minute boundaries. This makes your data segments not overlap.

One other suggestion would be to start a minute late, to ensure that the data will have all made it into the time slot. You could use -3m@m to -1m@m.