Is it possible to change the value of now
(or the reference point it uses) so that I can back-date and run a saved search that uses a relative time window? As an example, say there is a saved search that contains:
earliest=-1h latest=now | stats count by host
In this case I can't change the saved search, but I'd like to run that saved search for say 2016-01-01 01:00
. Can I tell the saved search to use that specific time as the reference point of now
?
I'm running the search via web export ( /servicesNS/<name>/<app>/search/jobs/export
), so curious if there could be a request parameter I could set or something?
For the backfill case you can just use fill_summary_index.py and tell it over which timerange it should run the searches. See
http://docs.splunk.com/Documentation/Splunk/7.1.3/Knowledge/Managesummaryindexgapsandoverlaps#Use_th...
You can't change the value of "now" - it is actually not the current time, but the time when the search started running.
But you can use an absolute time instead of a relative time for earliest and latest. Take a look at the topic Specify time modifiers in your search in the documentation. For example, you could do this
earliest=1/1/2016:0:0:0 latest=1/1/2016:23:59:59
Since you are writing code, you could just do the appropriate time math in your code...
As I mentioned I can't change the saved search, and it was only an example to make the point. There's actually hundreds of saved searches that use relative time periods and various calculations using now()
, many of them using summary indexes, which is why I was directly asking about the reference point used by now
so that I wouldn't be modifying the searches.
If there was a way to change where now
started from, all these reports could be very easily backfilled.
I may be going off on a tangent anyway, is it even possible to run a scheduled search remotely that is set to summary index?