I've got a query here that I'm using to find values over 3 different periods of time. Today, yesterday and two days ago. I've made this query into a report and attached it to a dashboard. I've also scheduled that report to be run every hour so that it doesn't create too much load on the server. When I make a change to the query, save it and run it, it works fine and goes to the latest point in time nearest to now. When I wait a while and refresh, that point of time does not change. So for example, I changed this query today at 12:15, saved it and when it ran it gave me data for today up to 12:00. It also showed the data from all of yesterday and all of two days ago like it was supposed to. I waited for about 2 hours and refreshed without making changes to the query and it still only showed me data up to 12:00 even though i have it to be run on a schedule every hour. I've even tried using cron to run the report every 10 minutes to see if it made a difference, Anyone know what might be happening here?
"Order Metrics" earliest=-0d@d latest=now | eval ReportKey="today" | append [search "Order Metrics" earliest=-1d@d latest=-0d@d | eval ReportKey="yesterday" | eval _time=_time+60*60*24]| append [search "Order Metrics" earliest=-2d@d latest=-1d@d | eval ReportKey="two days ago" | eval _time=_time+60*60*24*2] | timechart span=30m sum(order.membership_quantity) by ReportKey
... View more