I'm having a search query with datamodel command, and I want to use the results of this query in Db_Output. The query should be run specific time range.
The problem is, after configuring the DB_output with the datamodel query and cron, it always run the query on 'All Time' instead of defined time. (earliest=-1d@d latest =-0d@d)
Is there any way I can define time specifiers with datamodel. (tstats or stats can not be used, as query is not populating any statistical result)
query example, (query is using only listed commands)
| datamodel ... ... search | rename | eval | fillnull
Thanking you in advance.
Let me know if any other details are required.(DB Connect 2.4)
↧