We have got a requirement where, event logs need to be indexed under a metrics index. For this we are using mcollect command to ingest during search time.
For automatic conversion, we have scheduled a search to run every 1 hour, but in case of missed schedule data is lost for that schedule.
What is the best way to store the last indexed time and run the schedule based on the last indexed time?
Note: In long run we will be using LogToMetrics sourcetype for conversion, Until then we need to use the mcollect command.
