Hello All,
Hoping one of you can help solve the following :
This is what I want to achieve for a search which I need to display on a dashboard
Have a saved search run every 3rd day of month.( This i can easily get done by cron schedule )
The above saved search when it runs every 3rd day of the month should pick the raw events between 1st & 3rd of that same month.
So series of schedules of this search will be :
Search runs on 3rd July with Time range of events from 1st July to 3rd July
Search runs on 3rd of Aug with Time range of events from 1st Aug to 3rd Aug
...
...
Any ideas how I can solve this ? Thank you.
Hi saurabhkunte,
you can use the advanced time range options for this. Try something like this for your searches:
your base search earliest=-0mon@mon latest=-0mon@mon+2d@d | ...
this will search for the time range between 6/1/14 12:00:00.000 AM
and 6/3/14 12:00:00.000 AM
if the search was run today (16th of June 2014).
hope this helps ...
cheers, MuS
Hi saurabhkunte,
you can use the advanced time range options for this. Try something like this for your searches:
your base search earliest=-0mon@mon latest=-0mon@mon+2d@d | ...
this will search for the time range between 6/1/14 12:00:00.000 AM
and 6/3/14 12:00:00.000 AM
if the search was run today (16th of June 2014).
hope this helps ...
cheers, MuS
Sure, this will work for each month the search runs
Thank you very much MuS.
This works well. Just to confirm this would work also for subsequent monthly runs ? Thanks again.