Jeremiah,
Based on my understanding, using tscollect/tstats is not really meant to support backfilling ,e.g., you should do your initial tscollect query with the intention it will capture all of the relevant data you need at that time. Is that correct?
Regardless, I think I have stumbled onto another solution thanks to the documentation for tstats.
At first I disregarded using Pivot/Datamodels because of the limitations on the PERIOD option (e.g., 1 minute, 1 hour, 1 day, etc.). Now that I know tstats can access datamodels directly, is it possible to define a datamodel for my sensor data, accelerate that datamodel, and then use tstats to pull out the relevant data from the summarized datamodel at the time span I want, e.g., 5 minutes instead of 1 minute if I used PIVOT command? The command I have in mind would be like the following:
| tstats summariesonly=t prestats=t avg(Sensor_Field_1) as Sensor_Field_1 FROM datamodel=mydm BY _time Endpoint_Name span=5m | timechart span=5m avg(Sensor_Field_1) by Endpoint_Name
The other benefit with this solution is the datamodel will sit on the indexers in the distributed environment and I won't have to maintain nearly as much in terms of savedsearches, search head access, etc. The Pivot/Datamodel framework would handle all of that.
... View more