Data Model custom timerange check

[vn_g]

How to pass earliest and latest values to a data model search?  Example if I select a time range picker of last 30 mins but still give earliest and latest in the normal search of last 24 hours, then earliest and latest parameters take precedence and works in a normal search. How to implement the same with datamodel query?

[vn_g]

1.I have time attribute added as required.

2. I have set the Summarization Period to run once in every 5 mins. (*/5 * * * *) and the old summaries clean up is default 30 mins.

3. Added summary range earliest time to 91 days.

4. Adding summariesonly = true, doesnt give any results --> for 1 hour as well.

[gcusello]

Hi @vn_g ,

the first question is what's the update frequency of your Data Model?

if it's more than 30 minutes , you cannot run a search on a Data Model in tha last 30 minutes.

Anyway, to search only on the Data Model without applying also the index events, you have to add to your searches summariesonly = True

Ciao.

Giuseppe

[vn_g]

I found a way to add earliest and latest using tstats from datamodel, but the values are not matching when querying from tstats and direct index? What could be the fix? I set the frequency to run once in every 5 minutes and earliest time to 91 days. And max summarization search time to 1 hour.

[vn_g]

1.I have time attribute added as required.

2. I have set the Summarization Period to run once in every 5 mins. (*/5 * * * *) and the old summaries clean up is default 30 mins.

3. Added summary range earliest time to 91 days.

4. Adding summariesonly = true, doesnt give any results --> for 1 hour as well.