To elaborate ... I need to get the last 30 minutes of activity for a custid where the custid comes from an ad-hoc query through a dashboard. The activity for that custid may have been in the last few minutes or a few weeks ago. The total number of records for the customer could be in the hundreds or the tens of thousands. I am using this search with a subsearch to find the time of the last activity and put it in an "earliest" clause:
search index=tlog sourcetype=csrv custid=$custid$
[ search index=tlog | custid=$custid$ | head 1 | eval earliest=relative_time(_time,"-30m") | fields earliest | format ]
| stats count by Env, Region
Perhaps there is a way to avoid doing two searches for this, I just can't think of it.
The reason that metadata doesn't help is that the "lastTime" field is for the index as a whole, and not by custid.
... View more
