i have a saved query that can show data up to 90 days.
But, when i run the search using the loadjob command, i would like to provide an option to view only 30/60/90 days data based on a users choice.
I see that i cannot use "earliest" with the loadjob command. Any ideas how to do it?
Basically, use user chosen days ( i.e -90d@d -60d@d etc ) on the loadjob savedsearch..
|loadjob savedsearch="testuser:testapp:testsavedsearch_ss"
= this gives me 90 days data
i want to have an option to show only 30/60/90 days data based on user choice from a drop down.
| loadjob
returns the result of the search you ran. you can not filter the results per-se
however, lets imagine your search is something like this:
... index=some_index sourcetype=some_sourcetype ... | stats(something) by something_else as something
you can add the _time
field after your by
clause and then have a search / filter after your | loadjob
... where _time > .... complete the rest
and have 30 60 and 90 in a drop-down (form input) or something
hope it helps