Hi,
I would like to give access to indexing volume per day and per index to all my users but they must only be able to access to their own index + summarized index (to keep it simple, let's say userA has access only to indexA and summindexA).
So I would like to do this by scheduling several summary searches (1 per user) taking data out of the _internal index and writing the results to users' summary indexes. A second search will take care of displaying the results.
My saved search is the following:
[Index thruput A]
search = index=_internal source=*metrics.log group=per_index_thruput series = indexA | sitimechart span=1d sum(kb) by series
cron_schedule = 15 * * * *
action.summary_index = 1
enableSched = 1
dispatch.earliest_time = -1h@h
dispatch.latest_time = now@h
action.summary_index.name = summindexA
I copy/paste this stanza and just replace "A" by "B" for userB, C for userC, D for userD, etc...
The search displaying the results is:
[Log volume (last 30 days) A]
search = index=summindexA source="Index thruput A" | timechart span=1d sum(kb) as total_kb
dispatch.earliest_time = -30d
dispatch.latest_time = now
I get some results but they are wrong: for some reason, the first search appears to ignore dispatch.earliest_time and is not only summing results from the past hour but from the whole day.
Also I've noticed info_max_time is not present in the summary search results, meaning that checks for overlaps can probably not happen. Is it normal behavior of sitimechart ? (another sitimechart search appears to work the same way).
Update My syntax for the latest_time was wrong: "now@h" was invalid and I should have used "@h". Not sure this is the root cause of all the problems but it certainly didn't help to get the results right. I've updated the saved search and will investigate again if I now get more accurate results.
... View more