Searching for period of months without rerunning search every month for complete timerange

[igschloessl]

I have a search which counts all ids events of the last 12 months by the severity. This search needs really long to run. So I dont want to rerun it every month for the complete time range of 12 months. I would like to just add the last month and search this over 6 monts.

My actual search is following:

index=ids  earliest="-1year@month" latest="@month"
| fields severity | timechart count by severity span=1mon

Thank you in advance

[ITWhisperer]

Create a summary index which you add to every month then query that index for longer periods