I use the below saved search and scheduled it and enabled the summary index.
| dbxquery connection=connectionname query="select startdatetime, enddatetime from tablename where enddatetime > ? AND enddatetime < ?"
[| makeresults
| appendcols
[| inputlookup kvstorelookup
....
....
| eval starttime="2018-07-19 23:00:01"
| eval endtime="2018-07-19 23:15:00"
| eval daterange=starttime.",".endtime
| rename daterange as params
| fields params]]
| eval _time=enddatetime
|fields _time, startdatetime, enddatetime
|table _time, startdatetime, enddatetime
When I run the query manually it shows _time as exactly same as enddatetime value.
But when it runs through scheduler _time is always stored as "2018-07-19 00:59:59"
I am not sure why this is happening. Can someone please help?
... View more